@rawsly - The ReCaptcha is basically it..
I see your concern and the question however, HS is no different than any other form on the internet.
I can take any form that submits with JS and drop it into postman, grab the exposed front-end key (if it exists) and make as many postman requests as I like.
Some mitigation steps that can be taken are
1. Force request origins from only known domains
2. CSRF tokens
3. ReCaptcha
You raise a good question though, and I think white list domains similar to how Google App Engine does it would be a really nice feature that I haven’t seen in HS yet.
So, I think you’re left with building your own security which would mean… Show no reminents of HS form submission in your front-end, sanitize the data when it hits your WP API as best you can, then submit the data through the HS API… and make sure you are doing front end and back end validation. You can also make sure the form submission origin is from your own domain white list…
This would leave a lot of guessing that would have to happen for an attacker to figure out the HS API endpoint to submit your form
If this answer helped, please, mark as solved 
tim@belch.io | forms.belch.io | Design your own Beautiful HubSpot Forms; No coding necessary.
Drop by and say Hi to me on slack.