A little off the beaten path, but maybe along the same lines....

I've gotten several submissions from our "contact us" web page from this address: baufaufru@mispir.org.

Every one of his submissions has had some sort of html reference to prescription meds.

I used to just get the normal spam from these guys, but now they're actually using my fill-in-the-blanks form to get my own website to send me spam! :/

And I am still amazed that people actually respond to those drug ads. They are such obvious spam.

Maybe I should offer a course in how to become an expert engraver in less than ten days.

They send me $100 and I send them a link to EE.

Philadelphia, PA (Really Bensalem)

When you finally understand it completely... it changes.

I don't know if his has the potential spam problem or not, but for ones that do, yes a different script is the answer.

The problem comes from generic scripts that pass the recipient email address from the web page. The more secure scripts have the recipient email address hard coded into them in a part of the script that can not be reached from the web. FormMail was a popular CGI script that is supplied by a lot of web hosts as a simple way to have a contact form. Similar scripts in other languages abound and work in similar ways, with similar vulnerabilities.

A custom PHP script with the address hard coded is typically the most secure. The next best thing is this PHP script that a friend of mine wrote, with a bit of advice from me, called "NateMail": http://www.mindpalette.com/formprocessing/index.php

It has a hidden list of recipient email addresses stored on the server and forms can only be sent one of the names you enter in that list. The list can not be accessed or overridden from the web.