Unfortunately there is no detail in the record's activity log to indicate the page where they came from or any web activity. |
Yes, it would appear you have some legacy back-end process somewhere, probably processing some one-off HTML form, that just throws data at the /save endpoint and expects it to stick (which to be fair, it does!). If the process included more info about itself (like a source field) you'd be able to identify it. Right now, it deliberately just includes the Email field and the Munchkin ID.
How do you prevent POST to the forms endpoint without a form id? |
If you turn the Admin Treasure Chest option "Reject Invalid Form" that should do it. But I don't advise switching that on if you're getting legit leads this way, unless you're sure someone will immediately holler, "Hey, my weird old form doesn't work anymore."
I would do a more thorough canvassing of all the possible people who could be maintaining legacy back-end code first. Tell them you're seeing HTTP form-encoded POSTs to the Marketo instance (app-nnnn.marketo.com/index.php/leadCapture/save) and hopefully they'll search their source code and find the culprit.