is there a way to stop a contact from creating a new account on the site, if they already have access to the website. The email address of the contact - not the primary email address of the account

I think you need a custom extension.

thats what i thought

We implemented something similar that creates leads support cases and contacts. All based on the email entered in the contact form.

do you think there is an extension already available for this? im sure someone is having the same issue