All links work and he can reset his password as many times he likes.
This sounds like a "user friendly" way to do things, but in reality this means anyone that gets access to their email at any point in the future (provided it's not deleted) can reset their password (and probably knows their account name from the email as well!). The same problem holds true if only the last link is ever active but it doesn't expire over time, so reset links should always be time dependent.
Only the link in the newest email works and the others aren't valid anymore.
This is now it should be done, and this should all be made clear in the email itself. There's really little reason not to do it this way; as long as I can click the "reset password" link (possibly then providing some other form of authentication for super-secure sites) to get a fresh reset link, there's really no reason to keep old password reset links active, they're just a security risk with no significant UX benefit.
Hopefully more security conscious users will actually prefer that your password reset links expire for security reasons, but you can also simply point this out in the reset emails: "For security reasons this link will only work for the next X minutes" or whatever. It's also a convention, and unlike password limits it's a convention for good reason, so following the convention can help your users understand the process and give them more faith in your process.
It does not matter which token is being used and all remaining links become invalid
The problem here is more hard security oriented; imagine I know what your password reset links look like, from my own account (say they're 10 character query strings). Now since I can generate infinite tokens each press of a button, I can greatly expand the space of successful password reset links, making it easier to attack. You can limit the number of reset links active at a time but...at this point you're just adding layers of obscure, awkward edgecase covering when just having one, single link, the standard method of doing this, would completely suffice.
This answer on Cryptography gives a little insight into the standard process for creating a password reset nonce. You can check out the general reasoning for nonces, there's a reason there's usually only one active at once; the more tries you get, the less secure you are. Especially since all the user has to do is click a link in an email, it's really not a bad idea to be picky here.
If you really, really want to cover the edge case of someone repeatedly requesting a password reset link (I really do think you're over thinking this), it would be much better to simply send the same password reset link for a short period of time.