We already prevent a user with an outstanding invitation from requesting another one. But once they're in the system and their invitation token has been cleared, they can request another one.
Change the wording on the invitation create page that says "If you're not already in our system" or similar. We shouldn't let the requester know that the user might already exist.
Add a conditional to src/middlewares/invitation.ts that checks if a user exists with the submitted email. If the user does exist, instead of creating a new invitation token, send them a reminder email that they've been signed up and give them a link to log in.