I created a Joomla 2.5 site (needs updated I know) for a client a while back, the site hasn't been maintained in quite a while. They contacted me today concerned about an email which was (thought to be) sent from the website - via the contact form.
Basically they have a single contact form on their site, name, email, message, send. Once sent this email goes to
Today an email was sent to hundreds of people with the title
'This is an enquiry email via theirdomain.com'. The message content was rubbish.
My question - is it possible to 'hack' the website contact form in this way? So that it sends to many people. Or, is it more likely that it's a spoofing scam? I know it's very easy to spoof a senders email address in this way. I know I could check the headers however I don't have the original email currently.
I would just like to re-assure the client that the email wad definitely not sent via the website. Also one more question, is it possible to disable the Joomla mail function completely?
I'm not aware of any logs that I can check to confirm any of the above.
Any advice or direction will be appreciated.