When our production instance was on 3.2.2, a logged in user could be given a link (or navigate) to the 'self-service enrollment flow, but when clicking on it, they would receive an error message. This seemed intentional and desirable, as a logged in user should not need to go through enrollment again.  In our upgrade to 3.3.1 the error message is no longer presented and the user who is logged in, can start a petition to create another user. 

The previous prohibited behavior, kept user's from accidentally enrolling twice, and minimized the amount of account maintenance. 

Since upgrading to 3.3.1 we've had a spike in duplicates that impact both our users and our admins. Please help us find a way to prevent an authenticated user from starting a particular enrollment flow.