Protection includes server-side validation, a request limit, and a hidden field that resists automated spam.