I used the Bitcoin client on my phone, after the transaction went through I clicked "Confirm transaction" and it has already accepted it. I'm guessing with smaller transactions they just assume it went through, otherwise they don't ship it within the hour you get the order, so they have some protection against doublespends.
I'm guessing that Coinbase monitors the Bitcoin network to detect double spends. A malicious double spender has to broadcast the second transaction very soon after the first. If you're processing Bitcoin transactions, you can just look for a second one. I think the chances of a second transaction succeeding if it's issued 30 seconds or more after the first are pretty low.
You can't spend Bitcoin without the public knowing, and that goes for double spending as well.
