Hi H,

1. We don't support SPPB 3.8.x anymore, we stopped a year ago.
2. As you already know one secrity level is definitely not enough.
3. Talk with your hosting provider if you can stop traffic from few "SPAM" countries, or use extra extension to lock them.
4. Check also Anty Spam settings (cPanel) for e-mail used in the Form, that also may help.
5. Consider using that plugin: CleanTalk Anti-Spam || https://extensions.joomla.org/extension/antispam-by-cleantalk/
6. There are also .htaccess rules that reduce fake spam traffic.

There is a Cyber War going on right now, on many fronts, and spammers also have a hand in it. Spammers don't care if it's your private site about butterfly collection, hospital site, or a rehabilitation equipment store, or even a government site. That's done by bots automatically scanning site by site. They are almost unpunished. Brutal true.

To be honest: this is a too easy answer.

I have another website with the same hosting provider with the same Joomla and SPPB versions, but with a different plugin for the contactform (Creative Solutions). Never had any problems with SPAM from this site.

So the problem is with SPPB, not with Joomla or the hosting provider.

Spam is random, one domain can be OK for many months, and 2nd can be target every single day.

I cannot help more if you decided to keep old extension.

I have upgraded the website to Joomla 5 and SPPB 5. Since the last hour I got now spam.

But lets's wait till tomorrow!

Have you set that? It may reduce some, but not all. To have stronger wall effect use > CleanTalk Anti-Spam.

If our European parliament dealt with this and not with silly things, the amount of spam in Europe would have been lower long ago, but no.... and everyone spends hundreds of euros on add-ons patching up the dam instead of changing the course of the spam river. After all, it hasn't been known since yesterday where most spam comes from.