@Laura K It sounds like it isn't so much inadvertent as by design! (Maybe not your ideal design, but Marketo Forms 2.0 are designed as self-service personal info forms.)
If you want leads to recommend others, there should be a different fieldset for that ("Invite a friend - Enter their info here") and you don't necessarily need to create leads for those friends; you can instead use a Send Alert flow step including the Most Recent Invited Friend data and let salespeople do the entry/dupe detection.
Both suggestions should be done to prevent this situation.
You can also block field updates on existing data by going to Admin > Field Management and choosing the field and block updates from FORM. I do this for all key data because a lead could overwrite their own valid data with junk data, ruining a sales person's day.