I'm thinking of using associateLead() to associate anonymous web data to known records. What happens if there are multiple records with the same email address? Which one(s) receive the update?
It wouldn't make sense to associate web activities with more than one lead. Only one lead can own the activities.
I believe the last updated lead gets the update here (with a minority of endpoints, it's the earliest created lead, have to recheck this API call to be sure).
Across the API, you should expect an update/upsert call that accepts a single lead identifier to update only a single lead (even in other cases where multi-update would be practical).
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.