There is also reCaptcha available for email orders, that was added a little later so if you're not seeing that then updating should sort it out. PayPal is different as customers go to the Paypal site to pay.
It might be more clear, especially for old senile guys like me, to have the cart admin text on the "Email Orders" checkbox say something like "Non-Credit Card Payments". I did not realize that the all the other payment options (other than PayPal) fell into the "Email Orders" category.