Steps to reproduce the issue

On 2 separate Joomla installs a contact was created without amending the default Contact Component settings. The email address for the contact was subsequently spammed with the website user first using /index.php?option=com_contact&view=contact&id=1 to check the contact existed. Then posted to the form which is available by default.

Expected result

Contact can't be emailed unless the form is enabled, and secured with Captcha

Actual result

The form was available to view and no Captcha or anti-bot mechanism was enabled

System information (as much as possible)

Fresh install, no changes made to Contact Configuration except a contact was created. Joomla 3.9.12

Additional comments

Web hosts see this as spam activity and one client's account was suspended. In both traffic came from the same IP addresses.