Nat-
You should also be aware that anytime you do an export to Excel, that Excel (or csv file) is ALSO being saved to a folder on your web server! If you have that server set up to be searchable in IIS, anyone can get to those files and see them.
I recommend, if you have sensitive data being submitted in a form, to write a script to clear these files out of that folder (default is \Portals\0\DynamicForms_Exports) on a regular basis and make sure you have your IIS settings set to not allow searching of those folders.
If you don't allow the results to be saved to the database, you won't be able to export them to excel at a later date. The only way you will be able to get the data that is submitted via your form will be through an email you set up in your completion events. (At least, that is my understanding!)