A common function of contact forms is to send the contact message not only to the site owner but also to the person who sent the contact request. What are good measures to protect against the form being used as a spamming tool by an automated script that submits it millions of times with different email addresses?
I can think of several approaches, but each one also has a downside or is not very effective.
- CAPTCHAs can be broken too easily nowadays and are a hassle for the human submitter.
- Rate limiting (only n submits per IP per day) won't help against a distributed script and may hinder proxied users.
- Spam detection may generate false positives and if it's resource-intensive will make the site susceptible to DDOS attacks.
Each measure makes it harder/more resource intensive for an attacker though so he might just look elsewhere. How prevalent is comment-form spam? Do I have to worry about it?