Just to report back on those workarounds you mentioned… filtering the Pharmacy Spam has so far worked for that particular spam, although there is now a new type of Russian spam coming in, which neither solution provided in that support topic fixed. We don’t use v2 reCaptcha but we use the “antispam” field to manually create a captcha, with different answers on each of our sites – this appears to get bypassed (unless they manually record the answer for each site, but I doubt they do that). Mandatory checkboxes are also bypassed. Others have reported their v2 Recaptcha gets bypassed, although I guess they might have been outliers, based on Justin’s comment?
I also hoped there would be a fix. But it’s been raised with NF many times over 3 months and their positions has always been that no action on their part is required. So it seems like we have the option of trying it with reCaptcha, putting up with the spam or switching plugins.