How to prevent contact form hacking?

Question

Burglary protection

There is a small site with a survey - www.drevstat.ru. The resource began to be constantly "hacked" - a huge number of messages come from the site (6,000 emails per day), while the messages contain anything, but not answers to form questions. As explained in the hosting provider's technical support service, "... the attacker literally "felt" a vulnerable script on the site (/include/js/mail.php) and used it to send emails."
Tell me, please, is it possible to somehow protect the resource from such "hacks"?

Answer 1

It is necessary to understand where the mistake was made and close the vulnerability.

Answer 2

You are passing extra parameters in the POST request (for example, subject).
As a result, you can influence the content of the letter. If you do not filter the data, you can also influence the text of the message itself.
Well, yes, as noted above, nothing prevents you from sending POST requests automatically - put a captcha or some kind of confirmation, in case of emergency.
https://www.owasp.org/index.php/Testing_for_IMAP/S...