Using profile HTML on an external site allows existing records to be updated by anonymous users

We created a profile in CiviCRM, with a Group field. There are 3 groups available for people to subscribe to.

The profile is set to allow duplicate creation, so existing records should not be updated.

However, when the HTML from the profile is copied to another site and used as a form there, posting back to the CiviCRM, behavior is different. In that case, a duplicate is created with two of the group subscriptions, but the third group subscription is actually added to the existing record when there is a match by email address.

This is a big problem, since we are trying to stop anonymous users from being able to modify existing records in the database, and because it means the "allow duplicate creation" does not do what's expected.

When the same profile form is used on the actual CiviCRM site, the option behaves as expected, and a new record is created with all of the subscriptions.

Both tests were done with the same profile and as an anonymous user.