Adding reCAPTCHA immediately after email is a must otherwise an attacker could send infinitely many emails to random addresses, which would lead to the domain being marked asspam. I was pleasantly surprised about how easy the integration ended up being.