In the case where a single record has a score that is out of bounds, there are two possible scenarios. First, the recipient of the survey may have modified the URL parameters to change the score of the survey by manually entering an 11. We were able to recreate the issue with this method. Please make sure that you have updated Simple Survey to the latest version. Simple Survey will no longer accept scores that are out of bounds for the survey methodology.
In the case where multiple records are created simultaneously, we believe that the survey invitation email was processed by an email scanner, such as Barracuda, which clicked every link in the email in rapid succession. This would create a condition resulting in survey records for each of the potential scores. This scenario is tough to replicate.
Another condition created by Microsoft Office365 Advanced Threat Protection (ATP) Safe Links is creating two duplicate survey records of the same score. So if you use Office365 with Safe Link protection, it "pre-clicks" the survey link to intercept potential malware/phishing attacks. If this is the case, you'll notice that one record will only have the score most likely with no Human Confidence Score even if you're using reCAPTCHA, and the other record will contain the score and additional responses.
Simple Survey now includes support for reCAPTCHA v3 which will identify surveys that have been taken by humans. Surveys created by an email or link scanner will have a low human confidence score. Surveys created by humans will have additional information and will have a high human confidence score.
We also recommend temporarily enabling field history tracking for the Survey Score to catch variations of this behavior, which may yield some additional information.