A client of mine was getting spammed via the online contact us form but simply adding captcha stopped it. Quite a lot of spam is just spider like programs crawling the net and posting their rubbish in any input or textarea they find and submitting it. I have seen cases in my forum logs where they have posted spam in the search box :-/

the contact form I wrote for them is a single PHP file with javascript and serverside input validation and uses captcha along with sessions.

__________________
Carbonize