Why does forwarding happen

Messages are forwarded based on choices made by the message recipient or system configurations at the host receiving the message.

For the purposes of DMARC, message forwarding which is evident in your reports usually occurs when messages are redirected elsewhere based on a system-level rule. i.e. the message does not get to the original recipient inbox, it is redirected by a layer prior to that. If a recipient receives the message, and manually chooses to 'Forward' it, this generally results in a message with the From header changed to use that recipient's address, so the resulting message will not show up in your reports as Forwarded via use of your domain.

There is nothing you can do to prevent recipients from forwarding messages. If you wish to have forwarded messages pass DMARC more reliably, you must sign the original message with DKIM for your domain. This improves the likelihood that the forward will still pass authentication checks.