Thanks for your prompt reply! As far as I can tell the token from the URL is parsing in to the hidden field, but if they put a new email address in to the form, the value parsed in to the hidden field is not being added to the new lead's info in Marketo.
The URL I'm using from the URL builder is http://ww2.digicert.com/example123.html?order_num=
And here's a screenshot of the hidden field settings: