"It does not have special security"
As you say, you do have captcha verification. Yes, it's "normal" security, not special. Do consider adding anti-spam. Akismet does a pretty decent job.
"I think the contents of my blog somehow angered him".
Most spammers (and hackers) don't care much about your content. They just want clicks to their sites. It's a constant arms race between spammers and victims - so be prepared to keep upgrading your spam defenses (and other security steps too) as you go forth. :)
It does not have special security
As a long term security pro, I've seen even "I regularly update and patch" users get nasty surprises when Google marks them as malicious sites because hackers regularly get small windows of opportunities to even get past those normal precautions.
Most good security requires you "Go Pro", but some basic stuff can be free. e.g., I have been using BBQ Block Bad Queries. The free version is pretty good and lightweight. We liked it so much that we built similar functions into our own wordpress security plugin + mobile app - ActiFend (alert: shameless plug :| ).
Unfortunately, WordPress security advice has largely been the same for years; ignoring recent trends in hacking. I did write something applicable to recent times - Does your WordPress Security Plugin really protect?