What 1.5.1 does is include an invisible item that the bots think needs to be filled in. If it is, the bot will get a confirmation of sending but, the email(s) will not go out.
What you are experiencing is happening to a lot of us. In some 4th world country, individuals are being paid to search for contact_us pages and fill each one with a bogus add. Just a single entry that does not raise any flags. And, if needed, the employee will fill in the required captcha data. For around $10 a day, they're getting a human to act as a s p a m bot sending out one every minute or two. In their ten-hour day, that's 300 to 600 a day. I imagine some are faster.
There is no way to stop this kind of spam. You can only take away the form submission process or remove your e-mail address from the site. Even, changing the contact_us page naming convention to something like spamTrap would probably not work for long.
What I use with my e-mail is Mailwasher. There is a free version and a paid version. It allows you to bounce, delete, and/or report emails while preventing the sender from ever knowing that their e-mail was viewed. Any other program will automatically send an acknowledgement if an e-mail is simply viewed in ANY other program.
Using its connection to spamcop.net, I can easily report offenders and do so to the tune of 30 or so a day per site. The more we identify, the more cpanel and other s p a m services will be able to stop.
You have to consider just how many valid queries are coming in and decide if they are low enough to make real customers call versus e-mail. IMHO, if real questions are 25% or more, I'm gonna live with the spam.
Need a hand with Zen Cart? Hire the team at myZenCartZone.com for upgrades, repairs, and custom plugins.
Zen Cart Certified hosting at myZenCartHost.com