Yeah I assumed they were one-time only. In examples I've seen, each link had a different token, so if you forwarded something, one of the links may work if you hadn't clicked that particular one.

When ever I explain this to people, and forward them one of my notifs from Facebook, they get pretty paranoid and shocked, then eventually accept it because of the convenience :)