Most likely your form was discovered by a bot. Bots don't care about form validation errors.
If you search for "reCAPTCHA" on the Community you'll see discussions about how to post-screen (it's not really "pre-screen") bot-submitted leads and quarantine/delete them.