If your oid is already in the wild (e.g. you've posted a form and someone's already started spamming you), changing the form now will have no effect. They'll keep spamming you. The easiest way to stop this spam is to implement a hidden field value and write a validation rule that requires the field value to be present when the lead source is a certain value (e.g. Lead Source is web, Anti-Spam is Yes). It doesn't have to be complicated, any type of validation will do.
If you haven't exposed your oid yet, don't. Instead, have the web to lead form post back to your server, and have your server submit the data (along with the oid) to salesforce, or even better, consider using the API, which doesn't have the 500 leads per day limit (assuming, of course, you're on EE or have API enabled).