The 'Contact Us' pane at the bottom of the page allows any visitor to the site to send emails without spam filtering to admin email boxes. Not seeing any settings for restricting this to user classes, or using CAPTCHA to eliminate problem people.

ACP -> Members -> Spam Prevention -> Captcha  If it's enabled it's also working for "Contact us". 

I do apologise, I thought I was testing it with my browser session that was logged out. They're just getting past the CAPTCHA then, and nothing can really be done about that. Any way to disable it?

Ah, just spotted you can indeed disable it from the Applications menu, and then pulling down the options for System and removing Guest from Permissions. Might be useful for others if suffering same issue.