Spam check accepts any answer

Hi. I've got a problem similar to an older thread where ECC+ accepts any answer to the calculation. I've checked that there are no com_users overrides in the template - that's not the problem. I am getting spammed hourly and cannot figure out if it's because of this or if the spammer is getting to another, unprotected login page.
The problem does not seem to be this one either:

joomla-extensions.kubik-rubik.de/forum/e...am-with-ecc?start=10

I'm on Joomla 3, ECC+, Virtuemart 3, and VP One Page Checkout all latest versions. This all worked fine in J2.5....