Hiya Lisa
I know you've been in the business a long time, and you're following what you believe are the correct procedures as you deal with this issue. And I appreciate that you're continuing to talk with us here on the board about it.
So I just want to suggest that you take a couple of steps back and consider viewing this thread from a completely different perspective. Try looking at it as suggestions being made by affiliates on how they wish an affiliate program would handle things when something like this happens.
Sure, the tendency is always to set things up to protect against the many 'bad guys' who are constantly trying to find ways to steal from you or damage your program and/or its processing capabilities. But as someone who does run a program, I'm suggesting that a more personal approach to handling something like this could have a lot of value to you.
We've found that most of the bad guys will go away once you contact them and tell them what you suspect, while the good guys will take objection to any such suspicion and go out of their way to prove their good intentions. The experienced bad guys have learned there's not enough profit in arguing after being identified, so they mostly just vanish.
Of course you want to protect your processing, and there's no reason not to suspend an account while investigating. But the main idea is to contact the affiliate webmaster to let them know the account has been temporarily suspended because of suspicious activity. If a webmaster doesn't respond to repeated messages that all signups are being refunded (when applicable), you can pretty much assume that was a bad guy and cancel the account completely.
There's definitely more than one way those transactions could have wound up being posted against a webmaster's affiliate account. And regardless of what your statistics may show, it's almost always better to give your affiliates the benefit of the doubt until you're really sure.
Simon
P.S. This post is meant to be taken as an 'in general' suggestion and not so much about the particular webmaster involved here.
P.P.S. We do use cookies for tracking and the standard thing is that the most recent cookie overwrites the existing cookie if there is one. Our cookies last just under 9 months if nothing overwrites them.
P.P.P.S. That said, I do want to add that I stand with everyone else here who's posted to say they don't believe SheepGuy would have done anything to defraud your or any other program.