- In case of two hosts sending ARP responses with distinct MAC addresses, the requester creates duplicated entries in the ARP table or keeps only the latest?
ARP maps IP addresses to MAC addresses; it's used when a host has the IP address and needs the underlying hardware address to be able to send the packet. It doesn't make much sense to expect to find the same IP address in two places at the same time, so the hosts only keep one entry in the table.
(Sending the same packet to two independent receivers either in a round-robin manner or by duplicating everything could be useful in some cases, but stateful protocols like TCP would get confused. E.g. one receiver would immediately send a TCP reset when it saw a segment to a connection it didn't know anything about. So it's not really useful on that level, but you could do something like this higher on the stack, like on top of UDP.)
- Why are 2 IP addresses mapped to a single MAC address an evidence of ARP spoofing?
It isn't. Not as such. The article assumes that the host doing the spoofing would be available via two different IP addresses. Perhaps so that the .43.220 address would be its legitimate address, and .43.1 a router it was spoofing. But a host trying to spoof the router would not need to be available under another IP address to the victim client. It might want to do similar spoofing in the other direction, to present itself as the victim client to the network router, but again, it only needs to present one IP address there.
(Unless of course it spoofs every client on the network to the router. But even then, I can't see a reason why it would be impossible to spoof each with a different MAC address.)
Two IP addresses mapping to just one MAC address could also be evidence of a host that just has two IP addresses configured for the same interface (for whatever legitimate reason). Or perhaps of something like proxy ARP where one host answers ARP queries for all addresses on a network block with its own MAC address.
Isn't the ARP spoofing evidence the other way around (2 MAC addresses mapped for same IP)?
Yes. Except that you won't have the two MAC addresses mapped for the same IP at the same time.
Your usual OS won't keep track of the ARP packets/mappings seen, other than the last one, and won't think twice of updating its cache based on any new ARP replies it gets, so without special tools, you might well miss anything being wrong. There's software like arpwatch specifically made to monitor ARP messages seen on the network and to keep history of them. With that, it's possible to send warnings if an IP address is seen to frequently "move" from one MAC to another.