Because most SSL based software packages have the root keys built in, the certificate on the stolen card will still work. Unfortunately, very few vendors use this field and not all software packages support it. Indeed, when Verisign issued two certificates to an entity claiming to be Microsoft for the purposes of code signing, they could not readily revoke them. Instead, Microsoft has issued a software update that specifically blocks those two certificates from working. Obviously this will not work if you plan to use smartcard based authentication within a company and need to revoke certificates.
Some smartcard vendors offer the possibility of creating identical cards.
Depending on your security requirements this can be a benefit or disadvantage. Generally speaking, if all you need is authentication, then tokens are a good choice. If you want encryption for web based applications, encrypted email, and so on, then smartcards are your best bet. Please do not send him mean email as it makes his email server sad. He's also a glutton for punishment and sushi.