A contact form is open to everyone. A bot fills the box. The form plugin’s own filter asks a hidden field or a question. Without that, the inbox fills.
The mail quota runs out for the same reason. Deleting spam opens the quota. It does not close the door. The door is in the form. The mail quota is read on the mail card.