Logged in to the customer's WordPress backend and enabled Cloudflare Turnstile (captcha) on all forms on the website. Additionally, enabled Akismet IP filtering based on the global blacklist. This should drastically cut down on spam submitted via public website forms.