HTML should be stateless... so unless you do something to save the fields, they shouldn't be saved.
If you attach a copy of the page and the email body and email includes I can take a look to see, but I really can't imagine the cause. Is it possible that google bots are hitting the page and it is sending from the most recent order in the database causing it?
It must not be sending only from form posts. I'm going to have to see the page and context to debug. Are you sure there is only one page that might send emails?