Spam being hacked into Lead Table

Spam being hacked into Lead Table

I am using the hosted CRM service, and like many others had been getting constant bot-generated spam through my Web-to-Lead form. So I added some "anti-spam" checking of the messages (looking for keywords and for url links etc..)

But I'm still getting spam messages and so after doing some more testing and debugging I have come to the conclusion that these messages are NOT coming through my Web-to-Lead form -- they don't have the extra formatting etc.. that I use to with legitimate messages.

How are they adding these spam messages directly into the Lead table without going through my form? If they have my OrgID, is there a way to get assigned a new one without creating a whole new account?