All our events are private and we use profile sync with Community Builder. As a result, the user often only has to click on the "Next Step" button since prices are normally calculated based on membership type.
It looks like the Duplicate Registration Prevention is only handled client side and ONLY when using tabs to get from the first field to the "Next Step" button (or giving the email address focus). When you directly click on the "Next Step" button, you can register multiple times.
Ideally, the Duplicate Registration Prevention should also happen server side and not only rely on javascript.
Second best would be that "Next Step" button would check for the duplicate registration prevention.