One visitor's form shows up twice among the submissions

Three ways it happens:

• A 207, then a new attempt. The first attempt was stored as an incomplete submission, and the corrected one was sent as a new POST, so it is a second submission. Continue the first with PUT /cdna-api/forms/submission/{token} instead of letting a correction post as a new submission; wire this into any JS-model form so it continues the original token rather than starting a second, incomplete one.
• A retried request. A POST that timed out may have been stored, and sending it again stores another. Nothing in a lost answer can be looked up later.
• A page-per-step visitor who reloads or opens the form in a new tab: the token is lost and a new submission begins.

Count and act on completed submissions only: a job that acts on them should run on the submission's Completed event. Where a duplicate complete submission would matter, add a Hidden element filled with an id your code makes for each attempt, and remove duplicates where the submissions are consumed.

See Submitting a form through the API.

In the API reference: Submit a form.