How to stop direct HTTP POST to a PHP script?

You must hook the form using wpcf7_before_send_mail and add your PHP code to functions.php (since the script is already in your theme folder)? You won’t lose any of CF7’s abilities.

function wpse_process_form( &WPCF7Object ){
  #process your form here
}

add_action('wpcf7_before_send_mail', 'wpse_process_form' );