Getting Spammed

You don't have to sign up for anything. I though you may want to glance through the thread in it's entirety (< 30 messages) to see the back and forth on the theories. Besides, the discussion is a hair too technical for me so I'm not sure which messages would help you most. Maybe this? It seems to sum up the problem.

Though I'm a perl coder, I'll chime in here. Been fighting this exact same thing for almost two years.

From what I can glean,

1. This is not executed from your form. Get that well: this is NOT executed from your form. It's either 
sent directly from the command line or from some program. They may initially visit the form to get the
 field names being submitted, but after that they're working on their own, probably from a compromised 
server they've hacked.

2. They can use **ANY** field your mailers process. Many solutions talk about screening the email field,
 but it doesn't matter. The most common approach I see is they use the Subject field to insert newlines
 and a bcc field. They then use the bcc field they create to dump hundreds of aol addresses, usually 
followed by a multipart mime message, complete with their own boundaries.

3. Given the above info, you would think you could stop them by removing any newlines in the mail 
headers. If you have success at this, great, but for whatever reason my attempts at this method have 
failed.

4. Important point to be learned from #2 and #3: even if you disable the "customer copy" and hard-code 
a mailer just to send to ONE address, it doesn't matter. They can use your subject, message, or other 
submitted field to create the BCC and spam addresses.

The only solution I have found is to screen ALL incoming data. ALL. If the following patterns are found

/b*cc\s*:/i ## BCC or CC
/content\-type/i ## This has no place in an email

Log it and immediately exit the program. This avoids other parts of your program being abused.

I put this trap directly into any read/parse routine.

The downside, of course, is if someone enters into the body of the message, "please send a cc: to....." 
the mailing will fail. But it's a good tradeoff because there should be a email field for a legitimate email 
reply address.

I'm sure there are holes in my logic and welcome any comments, but according to my logs this has 
effectively stopped this attack, at least for now. 

If on the other hand your problem is spambots missusing your webforms to send you spam I would
 suggest setting the permissions of the forms so that only authenticated users may use them.

Yes, this is the issue. I could only allow authenticated users to send form responses, which was a prevension method mentioned in the aforementioned thread, but I believe this would cut down on my inquiries. I'm not running a communtity site. And I do, in fact, have my email setting set properly.

Thanks for taking a look into this. I got hit with two rounds of this in the last four days. I checked my setup and I have the SUBJECT and FROM field set to automatic. Does this contradict your first point?

Your second point seems true because none of these messages have any BODY content. Another site that I manage that is getting hit with this does not use webform and those messages do have BODY content.

BTW, the opinion I posted previously (highlighted) is not my own.

Thank you for the tip. I uploaded this code and will report back here on how effective it is.

So far, so good. I was getting hit every few days, but I haven't been hit in two weeks after adding the code suggested.

The patch that is being discussed has nothing to do with registering as a user. Before installing it, i was getting hit once every few days. Since I have installed it (almost 6 weeks) i have not gotten hit. So we're assuming it works.

Restricting form access to users was just one proposed solution in an earlier message.