You're getting the error because the form is outdated - the form was created for a "different" user. Drupal's request-forgery protection is there for a reason.
Many sites have this "problem" and the best way IMO to deal with it is for the site to take the submitted form (during validate) and re-present it with existing user-visible values filled in (but obvs. new form tokens etc).
It is then clear to the user that the form has been refreshed and they get a chance to try to submit as themselves.
I expect, though haven't tried, that the refresh action can be achieved using a form validate hook that you ensure is run first, and if it detects the form token is not valid it creates a redirect back to the form URL on the spot.
Alternatively, educate your users that filling forms in anonymously is not wise!