A record has a number that doesn't fit the table prefix nomenclature. For example: an incident record has a number=5678890 instead of INC1234567.
The record is created from a list view that is generated by an invalid URL.
Viewing the log files at the time of record creation, I found the following:
That url is as follows:
If the record doesn't exist, you are presented with an empty list with a "new" button:
If the user clicks the new button to create a record, the fields included in the filter will be populated by the values, even read-only fields. This is what happened in this instance.
This is expected behavior. One way to prevent this from happening is to write a before insert business rule that checks the format of the number field and aborts the insert if the format is incorrect.