Morten,

If the emails are originating from webservers on your own network, it will be very difficult to block spam in the web forms (if I understood your setup correctly). This is because the only filter that can be applied to catch spam is the keyword filter, which is very, very inefficient, as it is usually used to stop very specific emails. All the IP-based filters cannot be used as the emails are originating from your own servers, and the Bayesian and SFDC filters won't work, as the emails are generated by your own webforms, and thus won't have usually the characteristics (headers and HTML content) of "standard" spam.