We have been having users sign up and get cut off in the registration process. They say the browser just timed out on them after pressing register. Thus we have been manually creating users, re-setting passwords etc. I'm getting emails saying people are trying to login with user names that do not exist.

If you're using Joomla 3.2 then they maybe experience the known password bug in Joomla. Please see the below topic regarding this.

www.joomlapolis.com/forum/153-professional-member-support/223367-password-reset-problem-joomla-32-and-cb-191?start=12#236611

As for the timeout issue that's normal. A session only lasts so long then it times out. They shouldn't take 10+ minutes to fill out registration. If they are you need to clean up registration or adjust your session lifetime within Joomla global configuration to 30+ minutes to avoid timeouts.

Also, I cant figure out how to turn off the double email that each user receives. One email is from CB Subs and another email is from the regular CB Users email set up in user configuration. I'd rather the user just receive one email.

You need to decide if you want the CB email, CBSubs email, or both. CBSubs will not conditionally disable CBs email. So you'll need to disable 1 of them if you don't want both.

I'm sorry I should have mentioned I'm using 2.5.16

Passwords won't be an issue here then only Usernames will. Joomla 2.5.16 and 3.2 no longer allow spaces in usernames. So if you're generating usernames from name this maybe blocking users from registering. Believe next Joomla release is reverting this change though.

What is a reasonable timeout time, do you think?

30 minutes is pretty reasonable for a minimum.

Is there anyway a firewall could create a timeout problem like this? Like could it be blocking something I need to create a security exception for?

No.

Regarding the emails, how do I disable the CB email. That's the one I don't want.

Edit either the pending or welcome email (whichever you want to get rid of) within CB > Configuration > Registration and empty the subject and body of the email. This will disable it.