I agree with Josh.
The fact users have found pre-populated information from another lead is primarily because they clicked on a link that contained a Marketo tracking code or because they filled out a form using the same browser used by the original lead. That can happen at event kiosks or just a comouter that was shared at some point. It is important to highlight there is nothing wrong on their part. That is just the way cookies work.
It is legitimate to mention they never filled out a form or clicked a link in an email that was forwarded to them. However, there are occasions when some lead posts the link on a blog or twitter and another user clicks on the link and then sees the pre-populated data. Note that any link that is clicked anywhere on the internet could contain the tracking information. So, they had the cookie even though they never clicked on any email link at all, forwarded or received directly.