But the simple answer is NO a new lead should not be created.
To Jack's first comment comment
A visitor is cookied, a new lead is created via the webservice api, the lead comes back and completes another form only this time with another email address.
I am assuming a new lead is created. However we'd like to setup a process where if the cookie id is the same, and the first email is flagged as a bad email address, that the existing lead is simply updated instead.
From the first paragraph, if the lead is submitted with the tracking cookie information then the lead is "tagged" or creates a relationship in the Marketo database between the lead record with the email address and the cookie record. This is a 1:many relationship structure as a lead can have one or more cookies but a cookie can have only one lead.
If at some point in time later, the lead returns and fills out a form with the same tracking cookie and edits the email address, then upon submit, the lead's email address will be updated. From my understanding, Marketo should NOT create a new lead in this situtation. It would only do so if the lead created via the APIs did NOT pass the _mkto_trk cookie in the first place.