So long as your form doesn't send a copy of the message to the email address included in the form, then there's not much to worry about.
Basically someone's running a script to crawl the web looking for contact forms which are essentially an "open relay" in that you can supply a message which gets sent to an arbitrary email address. The reason you receive a random text message, is that the script is going to check to see if it receives a copy of the text at the email address it provided.
If you're using formit for your contact form, you can include the spam validator and a field like this in the form:
<input type="hidden" name="nospam:blank" value="" />
There's a pretty clear example of it's use
here. I honestly don't know how effective this is though.
It's a personal choice but I don't use captchas on my own sites, because IMO a few nonsense emails received by only me (not clients or associates) is a small price to pay for prospective contacts not having to fill out a captcha. I know captchas are a necessary evil in some instances, but they really are frustrating at times, and certainly dont provide anything positive to your user experience.
If I was creating a contact form which will be directed to someone else, I'd have to make the call on whether they understand the concept, as to whether or not to include a captcha.
I'm a bit naive about server security I guess, but recently I realised you can actually use a cron script to update a blacklist of ips for iptables to use. It obviously doesn't increase protection from targeted attacks, but will certainly reduce this sort of shenanigans. I wouldn't recommend that route unless you're happy to get your hands dirty with iptables though.
