Can somebody flood my booking page with fake bookings?

It is limited. Only a handful of bookings can be made from one connection each hour, and the form carries a hidden trap that bots fill in and people never see; anything that trips it is quietly thrown away. Real nuisance bookings are a human problem: mark them No-show and the record keeps the name.