You also have to take care that they might go even further back and get a new form as well - but then it quickly become a matter of adding more state in the sessions.
They dont log in so it would have to be a hidden value, dont think that if they get another form would be a problem as the message if backbutton hit would only apply if the property is already booked, and the message would only appear on the bookingverification page.
Not fancy of using sessions, suppose there arent any other way. I have sessions in the intranet, so I now that point, but not how to store and do the random value. Thanks