Form has no security & can send email to any email address with any message

My hosting co said they had a problem with spam coming from my site and shut down my email. After investigating further, they wrote:

Upon further review, it looks like your recommend to a friend plugin is the culprit here. The form can be used to send email to any email address with any message and has no security measure to prevent bots, such as a captcha security measure.

We will need to leave the mail disabled for this account until the form is removed from the site or secured.

Please let us know if you have any other questions or concerns.

Thanks,

Joshua Browning
Support Manager, Site5.com