This static page holds no secret and no destination. The form fetches a single-use token, solves a server-verified captcha, and the endpoint delivers the message to the bound mailbox — server-side.