You can only reuse email tokens within 24 hours.

app/models/email_token.rb

@@ -19,6 +19,10 @@ class EmailToken < ActiveRecord::Base
   end
 
   def self.valid_after
+    1.week.ago
+  end
+
+  def self.confirm_valid_after
     1.day.ago
   end
 
@@ -38,7 +42,7 @@ class EmailToken < ActiveRecord::Base
     return unless token.present?
     return unless token.length/2 == EmailToken.token_length
 
-    email_token = EmailToken.where("token = ? and expired = FALSE and created_at >= ?", token, EmailToken.valid_after).includes(:user).first
+    email_token = EmailToken.where("token = ? and expired = FALSE AND ((NOT confirmed AND created_at >= ?) OR (confirmed AND created_at >= ?))", token, EmailToken.valid_after, EmailToken.confirm_valid_after).includes(:user).first
     return if email_token.blank?
 
     user = email_token.user

spec/models/email_token_spec.rb

@@ -118,6 +118,16 @@ describe EmailToken do
         email_token.should be_confirmed
       end
 
+      it "can be confirmed again" do
+        EmailToken.stubs(:confirm_valid_after).returns(1.hour.ago)
+
+        EmailToken.confirm(email_token.token).should == user
+
+        # Unless `confirm_valid_after` has passed
+        EmailToken.stubs(:confirm_valid_after).returns(1.hour.from_now)
+        EmailToken.confirm(email_token.token).should be_blank
+      end
+
     end