Maybe I'm missing something.....but couldn't you just go create a free Gmail account and try to send an email through your contact page?

...And just because the email doesn't go through, that doesn't mean a competitor is redirecting the email. I think the "KISS" principal probably applies here.

Thank you all for your reply.

Let image you are the attacker. The worst thing you want is for me to find out you're attacking me. The mentality of the attacker is to be stealthy.

If you are intercepting the email messages sent from our web form and diverting the messages to yourselves. How are you going to prevent me from knowing it?

With my limited knowledge I can think of detecting IP. By knowing my ip your scrip can allow me to send a test message without blocking / intercepting me. So that I would be fooled to think everything is OK.

Of course another way for your hacker program to distinguish between a genuine new potential client and our anti-hacker team is to detect where are they from.

If the referring link is from our Google Adwords then likely it's a genuine new potential client.

If the referring link is from nowhere then likely it's a anti-hacker engineer and you don't want the anti-hacker engineer to know this attack is taking place.

These are just 2 of my most superficial rules in an enormous rule-base for your webform-intercepting-script to stay stealth.

As you know in order for this attack to stay stealth it would require a lot more sophisticated rules than these 2.

Because our anti-hacker team won't be so stupid to test our site from nowhere, of course they would pretend they are a genuine customer by clicking our Google Adwords.

We only run our Adwords locally. So you don't want your script to intercept visitors from a foreign ip.

I can pop into any local hotel, bar, or any other easily accessible Internet terminal to send myself a beautifully drafted test message from our web form.

So your script must know all the ips of local hotels, internet cafe, etc, and take them into account in its rule-base.

I can ask my friends to run a test from their office computer. So your script must know who my friends are. You have to implement a Trojan horse into my cell phone to do so. Your also need to hack my friends cell phone to know who their friends are. Worm may come to mind. So that your script won't intercept their messages.

With my limited knowledge and experience I can only think of these rules. There are probably other holes missing.

Your script must be invisible in a normal FTP client if you decide to hack our hosting server .

What makes me think this attack is happening? Because it is not logical to receive 3 new contacts in one day then zero for five days.