I have a simple store running on Magento 2.4.6 p2, with guest checkout disabled. I have added Google captcha on registration as well as login form. Still, once in a while, I receive spam orders like this.

I am unable to find where the vulnerability is on site. How to find out where these orders are getting placed from, and how Magento allows an order to be placed without name of customer.