cameraman - 8:01 am on Jan 28, 2007 (gmt 0)

One thing you can do to insure that the 'user' is following your submission process from the beginning is to put a token as a hidden field in the form. The token can be generated in a variety of ways from various bits of data. You want the token to be dynamic and moderately unique, by for example combining part of the time-of-day with the user's IP address. Keep in mind that some users' IP addresses can change during the normal course of a transaction, so don't base any assumptions on a 'static' IP address. You want the formulation to be complex enough that someone on the other side won't be able to figure out your algorithm easily.

Ideally you would compute the token at the beginning and store it in a database. Set the token as a hidden field, then when you're processing the form you compare the submitted token to the one you stored. If they match, then this submitter has been on board from the beginning.

Alternatively you could compute the token, set the hidden field, mangle it a little more and store it additionally as a session variable. Then when you get the form back, take the submitted field, mangle it the same way and see if it matches the session variable.

Lastly you could compute the token, set the hidden field, then set hidden fields containing the original data you need to recompute the token. If you're using a combination of time-of-day and IP, for example, you'd set hidden fields for the token, the time of day, and the user's IP address. When you get the form back, you use the original IP and time of day to recompute the token. If it matches..

So there's the theory. It's been too long since I've done anything in ASP so the following is in 'pseudo-code', that is, not any particular language.
Given:
Time/date = 11:59:15 25 Jan 2007
userIP = 12.34.56.78

mangletime = (hour + minute + seconds) * date / month ((11 + 59 + 15) * 25 / 1) = 2125
mangleIP = sum-of-components (12 + 34 + 56 + 78) = 180
token = mangletime * mangleip * 3.14 (2125 * 180 * 3.14) = 1201050

So tack on to the form:
<input type="hidden" name="token" value="1201050" />
<input type="hidden" name="submittedtime" value="11:59:15 25 Jan 2007" />
<input type="hidden" name="submittedip" value="12.34.56.78" />

Then when you process the form, run through the same process using submittedtime & submittedip and if the token matches, a spoof is highly unlikely.

Is the generated number absolutely unique? No, the same number will be generated if the ip is 34.12.56.78 or the time is 11:15:59. Does it matter? No, we just need one that's not going to wind up the same for everyone every time they visit and is hard to figure out how to mangle.