David,
What type of referrals, exactly, are you trying to track? There is a simple way to track referred signups to your lists, if you're interested.
I think all subscription systems are susceptible to abuse. There is no way to prevent people from entering email addresses that are not their own. All you can really do is send a double opt-in message and/or make sure to include full details of the subscription including the referring URL, date added and the user's IP address. You might also set up a "report user for SPAM" system on your site. If you detect someone abusing the system, a method to identify and prevent/deter them should be implemented as soon as possible.
Regards