Its possible to just remove the captcha input field "name-recaptcha-id" (e.g. kontakt-recaptcha-1) via inspector or something to bypass recaptcha check. With this missing input field, the "recaptcha-token" is not processed. (Which can be removed by user, too!)
So an attacker could easily spam the form again.

When checking if we have to process recaptcha-token, you should not believe the "name-recaptcha-id" field, instead there has to be something server-side which knows whether there was a captcha displayed or not.