How are messages sent from an unpublished Contact Form 7?

Question

Fight against spam

I have a HOA website, where, in order to send an application through the contact form, you need to register, enter your personal account and add a personal account, by personal account number and apartment number.
Only after that, the php script checks the connected LAN and adds the form there.
At the same time spam safely falls.
And there are few users with added drugs, and these are all real people.
Can the spammer somehow access the form bypassing this mechanism. Through the API, directly ... Maybe I need to disable something?