WPForms

On futher investigation into the compromising of contact forms I started to speculate on whether an email address could be verified on a form before it was submitted. I have observed that the simple Wordpress Contact form will allow the submission of the form without checking that the email address actually existed.

The consequence of this is that a contact form could be "spammed" or "used inappropriately" by filling the email field with text that looks like an email address (has the correct format with an @ and a domain after the @). These emails did not exist and they were not checked.

There seem to be many ways that this can be achieved - a Wordpress admin that sees this as "abuse" should not be the admin of a Wordpress website.

The WPBeginners website said:

As I am not using a contact form this discussion is a little accademic.