It's my understanding that the spammers parse the form's HTML to determine which fields must be submitted and the URL to which they must be POSTed.
Remember, you don't need a perfect solution to this. When you and another person are being chased by a tiger, you don't need to outrun the tiger, just outrun the other guy.
