You are probably not breaching GDPR1.
First, consent(art 6.1.a of GDPR) cannot be implied, but it does not require that the user formally ticks a box. If you leave a field for "E-mail to answer back to you" and the user fills it, he has already consented to you processing his e-mail for the specific purpose of answering. It would be a "clear affirmative action".
Asserting that you have consent could be a little more complicated if you were forcing the user to provide the e-mail in order to send the form, since consent must be "freely given". If the kind of communications that are send to you may not require a reply (for example, to inform you that your website has some mistake), then it could be better to leave the e-mail field optional2.
Besides, consent is just one of the motives that allow you to process user data, and you might have a legitimate interest(art 6.1.f). For example, to avoid being spammed you might want to have a system that sends a confirmation link to that address, to confirm that it is indeed a legitimate user and not some bot, or to filter out messages send from some particularly troublesome person.
The limits of legitimate interest are a bit fuzzy, but I would be surprised1 if this use would not be contemplated as legitimate.
I'm not storing any of the data in a database or in cookies.
is irrelevant; GDPR does not bother with the technical details of how the information is stored. It does not matter if you have the e-mail in a cookie, a database, a contact in you e-mail client or written in a clay tablet, what matters is that you have that piece of personal information.
I am not a lawyer, I am not your lawyer.
2Although in that case maybe you could say that contacting you to complain or inform about mistakes in the web is not a "service" by itself. Practical details of laws may be complicated, and the GDPR still has little case law.