Hi Joe,

Facts, global research shows that at least 60% of the website(s) traffic comes from bots, scrapers, and hacker scripts that visit your site to steal content, search for vulnerabilities, or try to find your users’ passwords. All websites are under pretty much 24/7 constant attack.

1. ReCaptcha v2 Invisible
2. Using extra plugin to prevent SPAM visits
3. Adding extra field (choose), not only input as you probably did
4. If you know IP from where those messages goes you can lock them all (one by one) or even whole country.

ad 3) Make research on JED. For example try those:

• https://extensions.joomla.org/extension/access-a-security/site-security/ospam-a-not/
• https://extensions.joomla.org/extension/access-a-security/site-security/badbot-protection/
• add extra rules to .htaccess file from 7G Firewall or 8G Firewall beta (perishablepress.com)