Tracking this spammer almost impossible (Score 2, Interesting)

A bot of some sort came by one of our clients web sites and found a hole in the 'contact us' page. I'm guessing this bot used some sort of a Google search to find likely pages. It submitted the contact us from 5 times, with various values in the fields...each time, trying to send a bcc: email to an aol address. It worked on one of the posts...they found a hole. Later that night, we had a few thousand emails sent through our server via carefully crafted posts to our contact us form. Tracing back the ip addresses, one came from a wide open proxy server in Vietnam...not much of a way to trace that one back to the source. Amazing how this whole process is probably automated. (BTW, the spam worked. It was for a particular penny stock that doubled in price over the last few days. Someone just doubled their money.)