A devious method of hijacking a form is to insert line breaks into form fields that will be used in email headers.
After the first line break, the spammer can insert a Bcc: line with a thousand email addresses (an arbitrary number, which could be more or less depending on how many addresses the spammer thinks your server can handle in one gulp).