as I mentioned, a user, who registered manually, used a built-in contact form to send spam to some of our members.
This user has been disabled and is no longer active. I just changed the setting of this forum (it's strange: the forum has an option that prevents the user group "registered" from being contacted by mail form - but another hidden option just overwrites this) and it should no longer be possible.
Important: The spammer was not able to see the mail addresses. It was only possible to fill the contact form to send the message to a user.