We have lots of old deploys; searching the forums it seems like deleting old deploys is not really an option; and I understand/respect the reasons.
In our case, we added recaptcha to our forms because we started getting spam, but all the old forms don’t have that protection.
Troublingly, the submissions on deploy previews don’t show up at all in the form submissions!
I am not 100% that it is old deploys causing the spam; but I can submit forms on old deploys and they don’t show up in our submission list. So I think it must be the case that old deploys are pointing to old form configs.