Contact_us technical question(s)

[RixStix]

We received an obvious spammer email via the contact us page. First one in ages. Something just doesn't look right (other than the location of the IP).

Is this cause for concern or something to just delete and move on?
They've figured out how to get around the hidden field

Contact us by my test account yielded 2 lines in the logs. 1st was a POST, 2nd was a GET
zenid was the same in both lines

199.xx.yy.zz - - [11/May/2016:13:55:16 -0700] "POST /index.php?main_page=contact_us&action=send HTTP/1.1" 302 20 "http://chainweavers.com/index.php?main_page=contact_us&zenid=574b596e2bcf2e2988d5a59db139d700" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0"
199.xx.yy.zz - - [11/May/2016:13:55:17 -0700] "GET /index.php?main_page=contact_us&action=success HTTP/1.1" 200 7970 "http://chainweavers.com/index.php?main_page=contact_us&zenid=574b596e2bcf2e2988d5a59db139d700" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0"

Contact us received in question has 4 lines associated with it. GET, POST, GET, GET
GET #1 has zenID
POST has different zenID
GET #2 has no zenID
GET #3 has no zenID

46.161.9.20 - - [11/May/2016:13:02:35 -0700] "GET /index.php?main_page=contact_us&zenid=a1d68a7ba6b02a81a003fcdb1a2603c4 HTTP/1.0" 200 41358 "http://chainweavers.com/index.php?main_page=contact_us&zenid=a1d68a7ba6b02a81a003fcdb1a2603c4" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
46.161.9.20 - - [11/May/2016:13:02:36 -0700] "POST /index.php?main_page=contact_us&action=send&zenid=a0a956dae2b8687bf5f3c88800f7281f HTTP/1.0" 302 - "http://chainweavers.com/index.php?main_page=contact_us&zenid=a1d68a7ba6b02a81a003fcdb1a2603c4" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
46.161.9.20 - - [11/May/2016:13:02:37 -0700] "GET /index.php?main_page=contact_us&action=success HTTP/1.0" 200 33570 "http://chainweavers.com/index.php?main_page=contact_us&action=success" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
46.161.9.20 - - [11/May/2016:13:02:38 -0700] "GET /index.php?main_page=contact_us&action=success HTTP/1.0" 200 33582 "http://chainweavers.com/index.php?main_page=contact_us&action=success" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"

[DrByte]

I see nothing particularly alarming there.

They've figured out how to get around the hidden field

Not necessarily. Could be that they actually used the form, as a human.

[RixStix]

TNX DrByte,

I figured that was most likely the case.
That would some fast typing or even fast copy/pasting.

[DrByte]

A one-off experience of spam isn't worth worrying about. If it were a pattern then it'd be worth digging into logs, doing numerous tests of your own, etc.