Guestbook Spam despite using 2.4.3

Spam is getting through. I'm using captcha and ver 2.4.3

I was suspicions upon seeing an entry from "Chris" saying nothing more than "Nice site!" repeated 1 hour 2 mins later. What human would be still around an hour later and so precise in duplicating the message, except for different capitalization in the URL.

The URL was visible only on the admin page. Turned out to be http://www.free###webcams

Now to figure out how it could get there. Has SQL access been compromised, maybe?