Three bot submissions landed 2026-08-30 with both selects carrying the placeholder label "Select one..." - required= is browser-only and a direct POST skips it. Adds a hidden honeypot (answers 303 so the bot sees success) and server-side checks on name, email, children, interested_in and source. Rejections are logged with the client IP and never touch any store.