How can I track down a script or form that's generating empty contact records?
Is it always exactly the same number of minutes?
If yes: could be cron related

If no: 
sounds more like a spammer. I would first look in apache/nginx logs and try to find at the time the user is created what exactly happened, which requests are done. First try to get the IP address of the visitor that entered the webform, then search through logs with that IP address and see what it does exactly. Is it the same IP address doing all the submission or not.
That could lead to clues of what to do.

It definitely makes sense to apply anti-spam techniques to your site. 


Mollom (https://www.drupal.org/project/mollom)
Http:bl (https://www.drupal.org/project/httpbl)
Google Recaptcha (https://www.drupal.org/project/recaptcha)


Are all techniques that can be applied to drupal and webforms