Ban IPs. If they are largely coming from a country you are not marketing in, consider blocking off that country as a "stop the bleeding" measure.
See what other patterns you find and ban IPs based on those.
Edit: I also remember people putting in fake fields that are not visible to the user. If they have any value in the form submission they are scripts and can be rejected.
See what other patterns you find and ban IPs based on those.
Edit: I also remember people putting in fake fields that are not visible to the user. If they have any value in the form submission they are scripts and can be rejected.