It appears that people are using my website to annoy people with unwanted email.
After a little more digging, I found another step in the process. The script would:
Create an account with an email like pa.rk.i.n.g.x.pe.rtdon.ma.na.h.a.n.@gmail.com and this sends out a verification email
Immediately change the account email address to a variant of the ...
Captcha will not help. It is easy for machines to solve and hard for people. You'll just annoy your users and you'll get little to no benefits. There are even Chrome plugins that solve captcha for you automatically so that you don't have to bother with it -- it's that easy.
I am working at URIports and checked our stats:
We are processing millions of CSP reports daily and found 99 CSP violations on 14 different domains containing div.show since 2020-07-01. Triggered by multiple versions of Firefox and Chrome on Windows, Linux and MacOS. This is probably caused by a plugin or extension.