Create form for candidates update their information

My purpose:
I would like to create a Public Web Form for offered candidates input their information before they join the company. Most of the fields are from DocType Employee, that’s why I create a Web Form from Employee.

My problems:

  1. When a form is submitted, a new record will be inserted into the database, that would make the data dirty, a lot of Employee records will be created. How can I make sure that candidate only updates the information of an existing record?
  2. Follow up question: how can I load the existing data to a web form? For example, I send a link to the candidate like /infor?personal_email=candidate@example.com, then it load the data from Employee by that email. The personal_email loads the email address, but I would like to load other fields of that record.
  3. When a candidate submit a form, how can I inform the HR team, and if the HR team approves, the updated data will be updated into employee record.
  4. If we use emails of candidates to load their information, the user information is leaked. How can I prevent this?