What Kevin said. However, I store the data to a local table in SQL to query from that for a lookup for each field.
If you have a lot of fields or you need to populate Radio Button or Checkboxes (can't populate those with lookup rules on 11), I have a nifty JavaScript that will collect each field and its value and parse it into one multiline field. You can use workflow to store the value from there in SQL in a column with unique identifiers. Then pull it back into the form with a lookup rule and use an array to populate the fields with those values. Set the ones you don't want changed by the external user to read-only.
It sounds complex, but it's simple to put together. If you want to email me, I can send you sample xml to load and walk you through the steps. angela@schooloffiche.com