Create one-time use "tokens" in a hidden form field. Once a token is used, it is deleted from whatever database or session context object you're storing it in. The second time, it's not accepted.
Cache information received, and if an identical form is received within a certain time period (10 minutes? an hour? You decide!) it is ignored.