Hi Patrick,
It's a neccessity to have a third party app (developed in-house) in this case as it goes beyond editing the form and performs a whole host of business logic tests which are not required at the form stage, I won't go into too much detail, sufficed to say, we were forced into this position.
Our webservice basically takes the validation from the SQL server or field types and NotNull, and then builds a Dataset based on these rules. We apply some extra validation where required in the form, and that validation is replicated in the third party app. The form is being filled out by people who are "less tech-savvy" to be kind, so we've kept it simple. The Third party app is for managing the data and is done by compliance teams who are a lot more "strict" on the details passed. The aim is, in the long run, to change the culture of our form users from just filling in nonsense to bypass the validation in the form (some will do this cos they're lazy), the compliance team get an incorrectly filled in form (i.e. it doesn't match the business logic requirements) flagged up to them by the 3rd party app and can look over the form and decide whether the form should be rejected back to it's creator to fix, or whether it's simply a small issue they can fix. The main aim is to get the majority of forms with errors fixed by the creators, so that they start to understand that if they don't fill them in correctly first time, they'll have to fix them themselves. Our form creators aren't paid by us so it's not like we can sack them for being useless.
What we're trying to do with this list is create a list of forms in a users library that have been filled in incorrectly. Being simple folk, we've made the /myItems.aspx page the home page when they navigate to the sharepoint site. We've added columns to the library which contain the reference of the form, and textual status, which is effectively a workflow, telling the users at what point their form is, once it reaches the final status "Finished" with a statusID of "10", the library simply filters out the form. I think this will work for us for now.