I require a form that people can only fill out once, and I also need to know and validate who that person is.
Google Forms requires a Google Account to enforce that the form can only be filled out once. But the account is not recorded in the answers. In the responses settings, you can ask for an E-Mail address, to which the filled out form can be sent, but that email can be different from your Google Account. So a malicious user could enter the E-Mail from a different person, and I have no means of detecting that.
Am I missing something? This seems like a super obvious flaw to me, but then … it's there for years and nobody seems to care.