In a typical case of finding a collision with an address, as long as the private key provided has a consistent public key that hashes to the address, then the coins in that address can be spent. The problem is that this assumes the collided address only has incoming transactions, and never an outgoing transaction. This is because that means the public key was never revealed but the address still has coins. In order for a transaction to be valid, it has to have a valid public key to verify the signature.
My question is this: if two outgoing transactions are made for the same address but with two different public keys (found by a collision), can the second transaction be confirmed if the first was already confirmed? Logically, the "righteous owner" of an address wouldn't have two distinct private/public key pairs for the same address (excluding multisigs), because that wouldn't make sense. Do clients even store the public key of transactions if they already confirmed it?