The nobot control is visible in the contact.aspx page:
<ajaxToolkit:NoBot ID="ajaxNoBotContact" runat="server" ResponseMinimumDelaySeconds="2"
CutoffWindowSeconds="60"
CutoffMaximumInstances="5" />
This is the info on nobot:
http://www.asp.net/AjaxLibrary/AjaxControlToolkitSampleSite/NoBot/NoBot.aspx
As they say, it's not quite as bulletproof as something requiring human intervention, but we've found it pretty good. It should be possible to see if the spam they are receiving is via the web form by the format of it (Kartris formats the messages in a particular way), or by checking the full headers to see whether the mail was indeed sent from the web server address or some other IP.
--
If my post solves your issue, can you 'Mark as Answer' so it's easier for other users to find in future.
If you would like to be informed of new features, new releases, developments and occasional special bonuses, please sign up to our mailing list: http://bit.ly/19sKMZb