"Fixing the door after the horse has bolted is a pointless exercise."
You think? Even if it stops a dozen more horses bolting? Or in this case, thousands of more spam emails being sent. As yet you have not posted any code from your form mail script. Perhaps there is something fundamentally wrong, or insecure that someone could point out to you. There are loads of known bad formmail scripts in existence (live on the web) that can be exploited to do such things as sending spam.