Assuming these spammers are not submitting via your form really, but just capturing your orgId and submitting forms directly to SFDC, you can add a custom field to Lead (or Case in Web To Case) — let’s call the field NoSpam. Then add the NoSpam field to your Web To X page as a hidden input field. Add an OnClick to the submit button which triggers some Javascript that fills that field with a set value (like “nospam”) (but come up with something else at random so spammers don’t just figure it out). Then you can easily detect if a human actually clicked the Submit button — only humans will have the expected value in the NoSpam field! So your validation rule would just be:

AND (ISPICKVAL ( Origin , “Web”) , NoSpam__c”nospam”)

This won’t defeat the most dedicated spammers who actually automate clicks on your forms, but it will work against spambots that just blindly submit form data without respect to form contents and Javascript. You could use this in concert with the validation rule described above to get a decent decrease in overall spam volume.

Try copying it again. It should work.

I entered your validation script and for some reason I keep getting a syntax error in the first 2 lines. Any thoughts as to why?