How could I secure a PHP messaging system from spam? -

i creating php messaging system , cannot seem think of suitable way stop spam attacks. message sent form (simplified contain essentials):

<form action="messages/send" method="post">   <input type="text" name="message" />   <input type="hidden" name="recipient" value="10" />   <input type="submit" value="send" /> </form> 

the hidden field above stores recipient id. data not secure on site , available people see (such facebook; profile.php?id=45345345.)

when form submitted back-end php following checks:

1. is sender logged in?
2. is send allowed contact recipient?
3. does message contain anything? (not empty)

the problem have thought of create simple script auto increment "recipient" value in form , send site-wide message. other back-end php checks, or other types of checks, carried out prevent happening?

you add few things:

• csrf
• server side , client side validation
• captcha - [http://www.smashingmagazine.com/2011/03/04/in-search-of-the-perfect-captcha/]
• the roboo script. demoed @ blackhat year , gives dos protection well.
• adding honeypot hidden field should never completed. can use javascript fill in automatically on legitimate form submissions , validate server side.
• velocity measures such how fast form submitted.

take @ - https://security.stackexchange.com/questions/4235/how-should-i-secure-a-contact-form-that-appears-on-every-page-of-a-website