Identified all the parts that need to be exchanged for security reasons.

The hashing needs to be done properly, not unsalted MD5. Bcrypt as a
start.
Recaptcha for spammer protection

The recaptcha is now always active, but only if the private/public
keys for recaptcha are set in the conf_main.php.