[Carnage]

my eventual solution to this was a very complicated form setup whereby each form was only submittable once.

You add an extra field 'formhash' to your forms, in the php you set a session variable $_SESSION['formhashes'] which is an array of all valid hashes. So you might have something like this:

$_SESSION['formhash'] = array('formhash1'=>1,'formhash2'=>0);

formhash 2 having been used is invalidated; when the script is finished processing you can delete it entrily from the array. I generated the hashes by simply MD5ing the timestamp . a random number . their userid

If a form with an invalid formhash is submitted you reject the data. I had this builtin to my input handling class so it was seamless on the forms it was used on.