What happens when the user returns? Do they need another email or do you leave the session around forever? If you leave the session, what prevents an attacker

What happens when the user returns? Do they need another email or do you leave the session around forever? If you leave the session, what prevents an attacker from grabbing your cookies that one time you leave your system unlocked? What about accessing the account from another machine? Do you then need another email each time? Does that access invalidate the tokens associated with other machines, or do you just keep proliferating tokens?