It already is being appended to your links. That's how initial association from clicked emails works.
Again, the problem -- if you are considering security/impersonation -- isn't what Marketo automatically does to associate web sessions. It's that you can submit a form on behalf of someone else regardless of whether anything automatic has happened, and regardless of whether Munchkin is even running.
The only way to protect against impersonation is to require that a form post include a value that can only be known to someone who can receive email at the lead address.
.png)