Jason ReedI was pretty sure that it was coming from the contact form, and to check this, I started having the ip address for the request to be injected into the message.
Finally after a month or so (thinking I was lucky and they stopped), we received another message and it had a simple IP4 address. So using this information I looked up the address on the RIPE database and found a name an email, that uses a range of this address.