Spam that is coming into the Contacts list

We have been having issues with what we thought were form submissions through emails in the Contact Us section of our website, but we have captcha on all forms. We are still receiving spam contacts as new leads, and we cannot figure out how they are coming into our list? They aren’t sending emails. Is there a way to find this information? Is there a log of some kind so that we can start understanding what needs to be done to stop the spam from getting into our account?