One way that this can happen is if you have a progressive profiling form and the lead changes their email address when submitting a subsequent form. As little as the email address will be captured in this case. I created an alert email for this situation that is sent to me and it includes the Anonymous IP address. I then search for that IP address and I can frequently find at least one other record, which I may merge with the new one if it looks like the same person, but different email addresses, or if it is two different people, I can usually update the company name and other info from the existing record with the same IP address.
Another way this may occur is if someone disables javascript in their browser, in which case none of the field validations work and they can submit the form with required fields missing.
.png)