We use Drupal as the content manager for the Healey Library website. For our contact forms, we use the Webform Contributed Module. We have gotten a lot of spam recently from bots that include BBCode in their submissions. Since we do not use BBCode on our site, I've taken the liberty of blocking all submissions that contain any BBCode. I've used the list of BBCode found on Wikipedia as a guide. Ever since, we no longer get any spam.