Form data:
Old data in a new form is no prefilter issue. Your form should be set to "Save partially completed multi-page forms"=NO
Prefilter:
the two WHERE are a bug but
all not logged in users have userid=0 and so every guest could see any record from other guests (if you show the list to public or somebody can guess the URL with your list id - as I can do)
So you should set your list access settings
add record=public
all other access levels at least registered
Old data in a new form is no prefilter issue. Your form should be set to "Save partially completed multi-page forms"=NO
Prefilter:
the two WHERE are a bug but
all not logged in users have userid=0 and so every guest could see any record from other guests (if you show the list to public or somebody can guess the URL with your list id - as I can do)
So you should set your list access settings
add record=public
all other access levels at least registered