It looks as if most of the spam is generated by software that detects forms and fills in a few random fields.

When we started getting a lot of spam, we simply added a check to ensure that the contents of one field was numeric.
If the field didn't contain numeric data, we returned a polite request for this field to be completed.
An email would only be generated if this field contained numeric data.
Also the email address was only contained within the PHP code.

Since we implemented this change, we haven't had any spam getting through from the form.

Hope this helps,

Tim
WebSphere MQ