The page /forum/memberlist.php?mode=contactadmin leads to this page that allows a guest to spam.
How to completely disable this "Contact a Board Administrator" feature in phpBB 3?
Sample spam message:
Hello Administrator,
The following is an e-mail sent to you through the administration contact page on "xxx".
The message was sent from a guest who specified the following contact information: Name: Barnypok E-mail address: [email protected] IP Address: 188.143.x.x
Message sent to you follows
~~~~~~~~~~~~~~~~~~~~~~~~~~~zd9hNf Link deleted.
The solution is to go to ACP (Admin control panel) > Contact page settings > Enable contact page > Disabled.