It could be a phishing scheme – I see a lot of them in the inboxes that appear to be submissions from the contact forms – but they are not. If it was an isolated incident I would think that might be it. Did you send yourself several test emails through the form? If so, did you receive all as intended?