UPDATE:
I received the second confirmation key this morning and decided to test it.
First I used the confirmation key that I ordered on the 23th of July and I got a new recovery key for the account:
About 10 minutes later I used the confirmation key that I ordered on the 16hth of July and I got a new recovery again:
That means, a confirmation key doesn't become invalid if a newer one is being used first. So accounts can be hacked for 6 months if the old owner still has a confirmation key for the account.
