Back in my early days of building static sites (non- CMS) we used various web to email forms that had no spam protections. This worked fine for several years. However, around 2003 spammers began using these unprotected scripts as spam engines to generate thousands of spam email messages to unsuspecting third parties. We started building in URL referrer checking code, and other things to protect against abuse of our sites.

You mentioned Contact Form which has anti-spam measures built-in. I’ve used it, and I like it. Given today’s prevalence of highly motivated spammers, I would never deploy web forms that could be exploited. Here is an article about web form spam security: http://www.nyphp.org/phundamentals/email_header_injection.php

And here’s an article about other web form security issues: http://css-tricks.com/serious-form-security/

Thanks again for your post.

-Nigel