When they do that, it's been our practice to turn off TAF in the store, rename the file (thus hiding it) for some days until the spammer goes away.

 

Left available for them, if they continue to exploit the page, your mail server can be blacklisted, and your site can be found to be violating your host's terms of  use agreement. 

 

As a note, we recently build script modifications that allow the merchant to dictate the number of consecutively repeated uses of the contact page, and of the authorize.net page, before we redirect the offender to an error page.  This was in response to the sorts of issues where stores are being used to test stolen credit cards, and some flake who tried to exploit a client's contact page.

 

Both of these solutions are available for purchase if anyone needs them.