With recaptcha it worked just fine till now, many, many months. I'm sure recaptcha was hacked recently because I started to get automatic submissions (different IPs) every 4-5 seconds during 1-2h, resulting in thousands of submissions and big server load. As disabling the button is impossible to achieve with perl I have to meter first access and last access. If difference is less than X seconds submission will not be processed. Seems the only solution at this time.