How is it possible that I keep receiving spam messages from a banned user (and flagged as spammer) who is still somehow able to use the contact form?

 

What am I missing?

They could simply use another browser and use the contact form the same as any other guest. There is also the chance people have been accidentally banned, and this would generally be the method they would let you know by. Personally, I just mark them as spam in my email when that is the case