Basically it adds a hidden form element which your users won’t see, but automated spambots will. If anything is placed in the textfield, validation fails. So instead of making the user prove that they are human, we allow the spambot to betray itself as a bot.