Email form invisibly allows spam by default

Using v1.7.42.3 -Admin v1.10.43 I discover that my site (and email server) have been sending out tons of spam without me realizing.

Problem 1: the default destination email address is something like your.email.here@example.com so without digging into settings I've been missing any contact form submissions this entire time. Also, the spam problem has persisted this entire time without me realizing.

Problem 2: the user is somehow able to customize the "To" field as well as the message content, which means they're able to send spam to strangers.

Problem 3: There are CAPTCHA settings in the Form plugin but it's not immediately obvious how to actually enable them, so my solution is to just disable the contact form and tell people to email me instead.

Problem 4: All of this is the default behavior of Grav, and in the ten minutes it took me to write this email I got 5 spam messages, so it's obvious that spammers know about this weakness and are actively exploiting it.

```
Return-Path:
Delivered-To: me@example.com
Received: by example.com (Postfix, from userid 997)
id 02B2F60C64; Thu, 11 Jan 2024 02:09:15 +0000 (UTC)
Received: from [127.0.0.1] (localhost [127.0.0.1])
by example.com (Postfix) with SMTP id EF4A260C60;
Thu, 11 Jan 2024 02:09:15 +0000 (UTC)
From: me@example.com
To: me@example.com, victim@mail.example.ru
Subject: [Contact] =?utf-8?Q?=F0=9F=92=B3?= BAM 83764.62p:
https://www.evil-website.example.co.uk/uploads/go.php?2cq0
=?utf-8?Q?=F0=9F=92=B3?=
Message-ID: <059fa76824fc72a3f1f5643ab3e852cd@example.com>
MIME-Version: 1.0
Date: Thu, 11 Jan 2024 02:09:15 +0000
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

=20
=

=

Start with the Grav Form plugin's default contact-form settings and trace how the destination address, submitted To field, message content, and CAPTCHA settings are handled. Reproduce the default behavior and document the changes needed so submissions cannot choose arbitrary recipients and spam protection is enabled or clearly configurable by default.

Written by the indexing model from the issue text.