I did this about a year back. We had a similar requirement where the serial number was generated in our production SaaS system. This serial number was not a random number but a specific number created by a specific backend system.
We also did not want to use javascript as it can be manipulated to generate fraudulant serial numbers and misuse.
You will need a bit of custom programming depending on where and how you are generating the serial number.
The components of the system for us was,
1> An external 'web service' which accepts a request, generates a new serial number and returns it via JSON.
I suggest to make this web service require password protection at minimum. Depending on how sensitive this work is you can look to add multiple layers of security from IP address restrictions, oAuth security etc.
2> In Marketo, create a 'webhook' which submits a request to this new web service. Configure this web hook to accept JSON returned by the web service, parse it and update appropriate fields on the lead.
3> After the web form is submitted, in Marketo smart campaign, call this web hook. This will fetch a new serial number in the lead field. Then send the email with this serial number field embedded in it to the lead.
There are some advance scenarios etc which might need tweaking. For example, can a lead request multiple serial numbers? Because in this situation, you only retain the 'last' serial number sent.
In our case, we had much complex needs such as approvals and so on. But wanted to just provide the simplified solution here.
Hope this helps..
Rajesh