In our CiviCRM installation contacts are either created by staff or they are created by a couple of different webforms. The webforms automatically include a Contact Source, and the staff are supposed to also but maybe don't always. Even if they don't though, the staff will show up in the change log for the contact.
Today I came across a number of contact records that have no Contact Source, don't show any staff touching them in the change log, and have no information in the contact other than an email address. Looking through the database, I'm not seeing any additional information, but I might not know exactly where to look. These contacts aren't registered for events, have no relationships, no memberships, nada. Only an email address.
I wouldn't really be concerned about this, but looking at the dates that these were created, there were a couple here and there a few months ago, but then each month since October 2023, there have been over a hundred each month. So it looks like it could be a growing problem.
I can't think of any way that these contact records are being created! Any ideas what to check? Maybe there is some exposed form somewhere?
