Marcin,

Currently, every contact message that is sent through our contact form is delivered to a POP3 email account.

Now that Incoming email processing has been recently enabled in CiviCRM, all email messages sent to this account will be processed by CiviCRM: the sender email and name will be added as a CiviCRM contact (if he can't be found on the database) and the message subject and body will be recorded as an 'inbound email' under that contact's activities tab.

There's also a configurable activity report (Reports -> Activity Report) that shows activities according to various search criteria.

Since our CiviCRM contact database can only be accessed by you and few more people from OSE, nobody has to worry about spammers finding their email addresses or any other personal information.