Multiple visitors on the same device
There will always be only one identifier on the device and that identifier determines the profile that will be used for that device.
Let us explain with an example:
Visitor 1 arrives on your website through a Campaign email. An identifier is stored on the device and the identified profile for Visitor 1 is updated. When visitor 2 uses the same device and arrives on your website by clicking an url in his email, Site recognizes that it is not the same visitor and the current Site identifier on the device is overwritten with a new identifier linked to the profile of visitor2. The identified profile of visitor2 will be updated as well (thanks to the parameter added to the urls in the email).
Although it is the same device and one single identifier, two different identified profiles remain and they will not be merged. The identifier stored on the device is now linked to the profile of visitor 2 and that profile will be applied to anyone using that device and surfing the website directly. This profile will continue to be used until another visitor activates their profile.
Each time visitor 1 or 2 visits the website through an email, the local Site identifier is overwritten. So only one Site identifier will be on the device.
Note: two identified profiles are never merged. Only an anonymous profile will be merged with an identified profile.