With every spend a random 50% of the private key is exposed. The reason that it is a one-time signature follows from what a second spend can reveal:
The overlap of the 2 random 50% reveals can be anywhere from 0% to 100%. Since it is random, the distribution for this will be on a bell curve.
Which makes 0% overlap (left/bottom of bell curve) and 100% (right/bottom of bell curve) overlap highly unlikely, 50% the most likely (middle/top of bell curve), and the likelihood decreasing faster and faster when you move towards either extreme.
But randomness being what it is, every value between 0% and 100% overlap can in practice occur. So if you are unlucky the overlap is a lot less than 50%, and in that case a lot more more than the theoretical average of 75% of your private key is exposed after the second spend.
This can be a problem because a possible attacker monitoring spent addresses can detect a second spend in progress, and until that second spend is confirmed he has time to brute force the missing parts of the private key and try to get his own spend of the funds in the address confirmed.
Any funds coming on that address after that are essentially gone the moment they arrive.