Spam mail created through CF7 Rest API

Hi everyone,

We’re facing the issue that one of our customer’s website is being used to send spam mails through the CF7 Rest API.

The log shows this clearly:

161.117.10.0 – – [18/Nov/2021:04:26:34 +0100] “POST /wp-json/contact-form-7/v1/contact-forms/58/feedback HTTP/1.0” 200 5276 “https://www.hilger-cem.com/contact/” “Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36” http://www.hilger-cem.com

I’ve seen that this has been an issue already 2 years ago.
Is there any solution available now? Of course, I can’t block the Rest API (e.g with Wordfence) as the plugin needs it to work properly. And I assume that other contact form plugins will face the same issue.

Help would be much appreciated!

Thanks and regards,
Jessica