I had this problem a while ago with a homegrown app. This may not work for you, but my solution was basically, "If the 'from' address states that it's from mysite.org, ignore it." Problem solved.

The other suggestions about form validation and locking are arguably the better way to do it, though. :)