First of all let's not overreact and call this an exploit because it's not. Joomla is not being hacked, it's doing what it's designed and told to do. It's just not what you'd think it should be doing.
Just because you have not created and published a contact form menu item doesn't mean that Joomla does not have one. When you add items in the Contacts component you are automatically enabling a contact form for each one of them. The non-SEF URL to get to them is well-known and predictable. It's easy for an automated script to access it and send spam through it – even without a published menu item.
There are a few things you can do.
The obvious solution is to not add anybody to the Contacts component unless you actually intend for them to have a contact form.
If you really need to put entries in the Contacts component regardless you can enable CAPTCHA on the form from Components, Contact, Options button, Form tab. Remember that you need to set up your CAPTCHA plugins in Extensions, Manage, Plugins first.
Another thing you can do is create a "hidden" menu (a menu without a corresponding menu module). Create a menu item for Contacts in there and set its access to Special. Because of how routing and access control works in Joomla you will be preventing access to com_contacts to everyone that's not a Manager, Administrator or Super User. When you want to add a public contact form later you can remove this menu item (and add a CAPTCHA to the contact form).
This is all core Joomla. There is no need to reinvent any of that in Admin Tools, not to mention it's a bit out of scope for it too.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
