Solution:
Because you haven’t written any validation code in your ajax callback function.
To validate your form, you must check each input field’s data before sending an email. Here is an example.
if(isset($_POST)){
if(!isset($_POST['fname']) && $_POST['fname'] == '') {
wp_send_json_error('Please enter first name')
}
...
}
The above code sample is an example of how you should check it before sending an email. wp_send_json_error triggers the error in ajax response so you will be able to display it on the client-side.
Although data sanitizing is not so much require for email but it is advisable when storing input into the database.