Reject Form Submissions with URL in them
It is possible to create contact forms using either the Webform module, or the Entityforms module. 

The beauty of the latter is the ability to attach fields, and to validate those fields with the Field Validation module, which offers a wide range of validation options.

There is a Webform Validation module for use with Webforms, but I think you will find Entityforms with Field validation to be a little more flexible and, perhaps, easier to use.

Either one should let you scan text for say "&lt;a href=" or any other undesireable word or phrase (blacklist matching) or constructs using regular expressions, if you are so inclined.