How public is the link to the form? Does it create an easy to script customer data mine? When doing anything that pulls customer data into a form
What I have done for mail out links is to put two custom fields on customer records. These are a hash and an expiration time stamp.
Before a campaign mailing I populate the fields. The expiration depends on the timeframe to respond.
These fields and the customerid are used to create query parameters on the inbound link to the form. The hash uses the customerid, time stamp and a secret.
The form gets a client script that reads those parameters and sends them off to a suitelet.
If the hash and time stamp validate then the suitelet responds with the customer details for the form.