The nobot control is visible in the contact.aspx page:
<ajaxToolkit:NoBot ID="ajaxNoBotContact" runat="server" ResponseMinimumDelaySeconds="2"
CutoffWindowSeconds="60"
CutoffMaximumInstances="5" />
This is the info on nobot:
http://www.asp.net/AjaxLibrary/AjaxControlToolkitSampleSite/NoBot/NoBot.aspx
As they say, it's not quite as bulletproof as something requiring human intervention, but we've found it pretty good. It should be possible to see if the spam they are receiving is via the web form by the format of it (Kartris formats the messages in a particular way), or by checking the full headers to see whether the mail was indeed sent from the web server address or some other IP.