not exactly a Perl question...

(Apart from JS) I'd try to solve this with a unique session ID in a hidden form field.

So repeated requests from the same form are blocked or cause a warning ("please wait")

This implies that the form is not static html, but generated by your script.

You can also combine this with a timestamp.