Spam received and sent via contact form

First thing to do is delete the contact forms.
Then find out if they were the latest code
Then let the authors know
But….
If this happening on other sites, you will need to talk to your host. Also check each and every directory you have for any files you did not put there. And if you find anything, download it then delete it.

Yes, I disabled all the contact forms at the moment. Installations with Textpattern were using the latest release, installations with WordPress the old version of Ryan Duffs contact-plugin. I upgraded all the WP installations to use Contact Form ][ (WP-1.5.x). It has subject field to prevent this kind of malicious use but this spam in question can assumably also bypass that see discussion here. And it has happened to other people too, see this message.
I did inform my host too.

This is the problem I am/was happening. I thought maybe it was wp-email. I was using old versions of wp-email and the contact form. I’ve upgraded both on one of the websites it was occurring on. Hopefully that will resolve it.

I just received email from my ISP telling that during past few days it′s been more than 20.000 spam emails that have been sent from my server using this contact form vulnerability. So this is really serious security problem.

Some additional required fields in the contact form won′t help. For now, I′ve disabled all the contact forms from my WP installations. I hope this is taken seriously and something will be done.

Yep, this is what I was experiencing from my website as well. I took down my contact for too. Hopefully there’s a solution for this…

nmallory: wp-email there is interval between each mail send which u can specify for each IP, and there is logging feature for every successfully/failed email. And it uses phpmailer which is the best mailer software outthere and I think in phpmailer itself there is also another secruity feature.

If your being hijacked, you’re going to want to use referrer or host checks. If it’s the script that has a hole in it, I recommend either getting rid of it, or patching it up yourself.

I got one spam e-mail via my contact form and immediately came here for advice and was told to get Bad Behavior.Since then, I have not had one spam comment sent to me via my contact form.