I believe there is a way to enable the free built-in reCaptcha protection for the contact form.
Try to enable it and check if the SPAM stops.
If this helps, you may also consider a better version of the function:
https://market.x-cart.com/addons/google-recaptcha.html
Also, what e-mail client do you use? It makes sense to check the e-mail headers and make sure that it is your server that sends the messages. You can find instructions for GMail here:
https://support.google.com/mail/answer/29436?hl=en