i have a contact form a website that does not have a captcha, so it gets the usual amount of spam sent through it. i also get empty messages from "root@localhost" this seems a bit worrying to me.

there's JS validation on the form and when i turn off JS and submit the form, i get an email from "unknown sender" with all the fields listed as having no value (= normal). so this is still a different scenario from the root@locahost emails im getting (these have no body text at all)

does anyone know how these root@localhost messages may be getting through? i dont mind the spam so much as i would suspected hacking attempts.