Yes, it is possible to use your site to send spam. The reason is the way the header fields are constructed. In short, every header field ends with \r\n (CRLF), and the headers are separated from the body by \r\n
headerfield1: value1\r\n
..
headerfieldn: valuen\r\n
\r\n
body
This means that anything going into the email headers need to be properly escaped or validated to prevent header field injection. The 4th formal parameter of the mail function is used to set headers. This corresponds to your $headers variable. But subject and recipient are also set in the headers which in your code corresponds to $webMaster and $emailSubject.
Since you only ever assign fixed string literals to $webMaster and $emailSubject, and neither of those contain \r\n, they are safe
$emailSubject = 'Request Free Consultation';
$webMaster = 'me@mydomain.com';
And if they weren't safe, you'd obviously change the code directly since these are set by you, not by user input.
This leaves the stuff assigned to $headers
$headers = "From: $emailField\r\n";
$headers .= "Content-type: text/html\r\n";
Once again, the second line is a string literal which you have specified, and it's all good. All that remains is to make sure $emailField is safe.
To get a full understanding of how this all works and what you need to do, you'd need to read the RFCs which specify the format of emails, or more specifically the header fields. And then you'd also need to know exactly how your server treats emails. For example, while \r and \n are not allowed to ever occur separately (i.e. they must always occur as the two byte sequence \r\n) it is entirely possible that your email server would happily send an email where one or more header fields are separated by \n only.
Assuming $emailField contains the string
john@doe.com\r\nbcc:spamreciever1@example.com,spamreciever2@example.com
which would turn into (not showing the CRLF characters but representing them as new lines instead)
john@doe.com
bcc:spamreciever1@example.com,spamreciever2@example.com
and thus two blind carbon copies are sent.
In this case, since the from header field is supposed to take one single email address, you can simply use filter_var to make sure that it is
$filtered = filter_var($emailField,FILTER_VALIDATE_EMAIL);
if (!$filtered)
{
# not an email address. do not send email
}
else
{
# safe to use
$headers = "from: $filtered\r\n";
}
Once this is done, you may still get spam - but you will be the only one to get it. Annoying but you do not pollute the world. If you wish to prevent even this, you might think about implementing captcha a user has to solve before sending an email. reCAPTCHA is one solution.
