If you are suffering from an influx of spam or unwanted messages through contact forms and you can’t block them completely by using reCAPTCHA or Akismet, the disallowed list feature will be of great help to you.
The disallowed list is originally a feature of WordPress to help manage comments. Contact Form 7 can also utilize it to blocklist specific words or IP addresses.
Disallowed list is quite simple to use; just log-into the WordPress admin screen, move to the menu Settings > Discussion, and then you’ll find the Disallowed Comment Keys section in the middle of the screen.
Put one word or IP address per line in the text box. Messages containing the word or sent from the IP address in the list you’ve created will be treated as spam by Contact Form 7 and will not be delivered.
How can you get the IP address from which the messages originate? The simplest method is by using the special mail-tag
[_remote_ip] in the content of the email sent to you. It will show the sender’s IP address.