Bug in headers? or something else?

Today i got an alert from my supplier that one of our sites were sending Spam.

I checked and in fact POstman was sending Spam from the contact form we setup but the strange thing is that spam was created in a site with recaptcha and the contact form created is quite simple.

What spammers are doing is adding a reply-to in the form sent that is not set in my contact form, and then all emails are sent with spam with a reply-to: random email.

How they add this reply-to: or any other headers?

I can provide link in private to check