How is the spammer getting by my safeguards?

You'd need to post the actual, raw data you're receiving in order for us to be able to tell, along with code (SSCCE). Perhaps they're using some Unicode characters (that don't survive your copy&paste)? See all the advice you got in your last thread Bad Language In Contact Messages.