Hiya Doug,
I can give you an answer from a sponsor's perspective. We use CCBill's affiliate program software, and that allows us to control how long a cookie is kept in a surfer's browser cache. We've opted for the maximum the system will handle, which is 255 days. However, you're correct that this system, like every other one we've previewed, does allow one cookie to be overwritten by another one of the same name.
In the example you presented, the surfer from Toby's site who signed up after getting 'cookied' a second time, the credit would go to the submitter who set the cookie most recently.
I've always been a little uncomfortable about this, but I've yet to find an affiliate system that offers a better solution than the standard "most recent gets the credit."
To try to balance the scales a little, there are a few things we do. One is that we don't use CCBill IDs for our own in-house tracking. So the urls on our pages which list our own paysite, our HFS and FHG, and links from our own traffic feeder sites, do not contain any IDs in the URLs which cause CCBill to set a new cookie. (I've seen this done the other way, where the same technique is used to cause new cookies to be set -- bad way to do things, I think).
We also set some cookies of our own, which are designed to store the affiliate's ID number so that in can be reinserted where needed. For example, if someone visits a HFS/FHG and crops the url to see what else may be there.
But none of that changes the fact that whoever most recently sends the surfer to the tour will get credit if he signs up.
I've wondered if there was a way to use "weighted" cookies, but that's a topic for another thread sometime.
Simon