Hi Joey
Sorry missed your question if this is expected behaviour. Normally it should merge the contact but ONLY if the email is opened in the same browser he got the cookie from point 1.
In Point 1. the user should get a cookie with a lead id.
In Point 2 you create another lead id with the email.
In point 3. you send a welcome email (make sure you enabled track_by_tracking_url in the config) which got the lead id encoded in the email links.
If the visitor opens the email link in the same browser he got the cookie from (in point 1) mautic should merge the lead.