What I've done in the past is use a [man]session[/man] value. Basically, when you generate the form and display it, create some random string of data (doesn't really matter what you use... [man]uniqid/man, [man]sha1/man of the current time with microseconds, etc.) and store it in the session. In addition, include that random value in the form data (e.g. as a hidden input).
When you process the form data, verify that the POST'ed hidden value matches the value stored in the session. If it does, clear the value from the session and process the form data.
Now, if they simply refresh and thus re-submit the POST'ed data, your script will receive the same hidden value from the form again, but the value will have already been cleared from the session; this mismatch will indicate that they haven't visited the form page again before submitting the form data.
