How to stop form resubmission on page refresh

Instead of …

} else {
    echo "<p>Your file has been uploaded.</p>";
}

… redirect to another address on success:

} else {

    $new_url = add_query_arg( 'success', 1, get_permalink() );
    wp_redirect( $new_url, 303 );
    exit;
}

Status code 303 triggers a GET request:

This method exists primarily to allow the output of a POST-activated script to redirect the user agent to a selected resource. The new URI is not a substitute reference for the originally requested resource. The 303 response MUST NOT be cached, but the response to the second (redirected) request might be cacheable.

In your form handler check first if $_GET['success'] is set and its value is 1, then print a success message. The visitor can reload this page again and again – and nothing will be sent.