There are various different things the spammers try so I won’t be able to tell you exactly what happened in your scenario without looking at all the income server request data. The captcha will stop all of those anyway and solve the issue.
There is an additional price verification that is done by our plugin after a successful API response. The post payment processing script will look at the webhook data sent by Stripe and match the price value with the data saved in the database for that product. If that validation fails, it won’t add to the orders menu (since it is not a valid transaction).
There is a lot more technical stuff that happens underneath, if you are interested, use the contact form to email us and I will give you more info.