Really??  That's strange - if you PM me the domain, I can do a bit more digging.

Open your Analytics.

Open Audience > Demographics > Language

Do you have any worthwhile languages to target after US and UK?  maybe a generic EN, maybe FR or de-de, possibly ES?

If you want to use a hreflang on .eu, I would suggest the generic EN.  That's what Google suggests here, as well:

http://support.google.com/webmasters/bin/answer.py?hl=en&answer=2620865

I'm confused. Assuming your site is at www.site.com and site.com, the duplicate is coming from a file, usually index.html or index.php, yes?  But it's the same index.html file.  So if you setup rel=canonical in index.html, both site.com and www.site.com will have a canonical on it.

(Or I'm missing something.)

You can definitely have multiple hreflangs.  This is the way to set it up:

The exact syntax to use in the header of the original would look something like this, for a site that has an original in English and alternate versions in Spanish (targeted to the audience in Mexico) and German:

(see: http://returnonnow.com/2012/06/international-seo-hreflang-tag/)

You should also deal with hreflang and alt languages in your sitemap, per: http://support.google.com/webmasters/bin/answer.py?hl=en&answer=2620865

I'm also fairly sure that Bing does not support hreflang. Only Google & Yandex do, I believe. I assume that will change as more international sites get their properties setup for Google and other engines want to stay relevant on international search.

If you don't use the site in Google, you should noindex it just to clear up any potential issues (especially if the domains link together in any way.)

• Bonus: How does one go about going through hundreds of pages with thousands of links, built with raw, plain text HTML to change things to nofollow? =/

Download the full site and open all the pages in Notepad++.  Find & replace.  Save, reupload.

What do the duplicate content URLs look like? In a lot of ecommerce systems you end up with parameter-based URLs such as:

http://www.example.com/products/women/dresses/green.htm
http://www.example.com/products/women?category=dresses&color=green

According to Google "When Google detects duplicate content, such as the pages in the example above, a Google algorithm groups the duplicate URLs into one cluster and selects what the algorithm thinks is the best URL to represent the cluster (and) tries to consolidate what we know about the URLs in the cluster, such as link popularity, to the one representative URL. However, when Google can't find all the URLs in a cluster or is unable to select the representative URL that you prefer, you can use the URL Parameters tool to give Google information about how to handle URLs containing specific parameters." (see more at Google Support)

If your URLs are parameter based I would suggest looking into handling them at that level in Search Console or (last resort) robots.txt as well. However, I'd start with canonicals and parameters if possible.