4
If the contact form is being used manually, a CAPTCHA won't help. By "manually", I mean that a human being is filling out the form and clicking the submit button, as opposed to an automatic script scanning the web for mail forms and submitting them.
You could capture some other info, such as the IP address, which is in the variable $_SERVER['REMOTE_ADDR']. With the IP address, you may be able to identify the sender's ISP, and they might be able to assist you. Or you could block that IP from your server.
