Having a static, number or text answer captcha won't really help with spam. Computers are excellent at solving math problems or matching text and the libraries of code the spammers use, especially if they have already found they can send email through your site, isn't going slow the spam much.
The following two methods (use both at the same time) are the current best ways of reducing bot form submission -
1) Add a 'honey pot' form field, that gets hidden using css, so that a human viewing your form won't see it and won't put a value into it. Detect in your form processing code that this field contains nothing. Bot scripts that blindly submit data for all the fields they find in your form will submit something for it. This will filter out the less sophisticated bot scripts.
2) Use a 'random' answer captcha, such as recaptcha or keycaptcha. These work better because the same initial question have different random answers and require interaction in the browser to solve.
Next, one of the (minor) points of using a captcha is to prevent bots from using server resources or triggering errors to help them find out information about your server and the functioning of your code. You should test the captcha first and skip over all other processing if it isn't valid.
The form processing code you have is overly cluttered, by all the variables and html in it, making it hard to see the forest for the trees. You should use an array to hold the validation error messages. This same array can then be tested to see if it is empty or not to determine if there are any errors. The logic to run the email code would just test if the array is empty. Only the error text should be stored in the errors array. Any markup for the errors should not be repeated and should be applied when you output the error messages to the visitor.
The test_input() function isn't actually testing anything and is poorly named. You should also not modify data (other than trimming it) before validating it. You should apply htmlentities() to any data you put into the message body, but only after you have validated the data.
Lastly, this is expanding on what NogDog wrote in reply #2, these emails are NOT being sent from the email address that someone entered in a form on your web site. If this portion of the code, without working validation, is what you have now, spammers have been able to send emails to anyone, containing any subject or message that they want, since you are putting user submitted data into the mail header, where it can be used to specify anything about the email. The copy of the emails you have been getting is just because your To: address is present.
These emails are being sent from your sending mail server. If the To: email address is hosted at your sending mail server, just use that address for both the From: and the To: addresses. If the To: address is hosted elsewhere, the From: address should be an actual email address hosted at your sending mail server.
The email address that was entered in the form on your web site, after being validated that it is only and exactly one properly formatted email address, can be put into the Reply-to: mail header.
