Spam has started to again come through in the past two weeks, the Spam submissions coming through fire a submit request and the message copy field registers as a new field after they submit. Just the difference in the submissions from spam should be triggering something no?
Examples of just the past day but it looks like it started two weeks ago.