Russian Bots hacked into my Active Campaign through the Genes eNew Extended Widget on home page

Hi,
So I just spent three days cleaning up a huge mess. I got hacked two time by Russian bots. They are getting in through the Genesis eNews Extended widget on the home page through the active campaign form. 
The first time it happened, they used the form to get into my AC account and upload 2107 emails, all from Russia. I found the form they all used and deleted it. I’ve been fighting with Active campaign, my hosting company and also the company I hire to do the security on the site. Everyone is blaming each other and there is no answer to how it happened.
I geo blocked my site from Russia, China, and Turkey entirely. Then put a new form up on my site last night and within minutes it started again. When I checked my email this morning in Active Campaign I already had 64 new emails from Russia. 
Active Campaign forms look awful so I want to use the Genesis eNew Extended but they don’t have Captcha on them. 
At this point it’s looking like the form on AC I was using in the widget was how they got in – twice with two different forms.
I just wanted you all to know this – here’s the thing – all the emails get into your account in Active Campaign without you knowing it. They do not show up on the dashboard as recent activity. You have to manually search for emails from Russia. I found them by accident because I was cleaning up my lists and looked for “bounced” emails. That’s where I found them – saw they were all from Russia, did a search for all emails from Russia and found 100’s more that had not bounced back from my welcome email auto responder. 
So now I’m terrified to use open forms on the site.
Jennifer, is there a way to get nice looking optin forms on my home page and side banner the way you designed it but also include a Captcha button?
Active campaign says I have to use their whole form, add the captcha on that and then use an HTML widget to put them on site. 
The screen shot is what the emails look like – so if you use Active Campaign, do a search for any contacts from Russia to see if you’ve been hacked. I’m blaming Active Campaign for this.