There isn't much you can do to prevent cheating other than using correlative methods and a banhammer. You can make it very difficult for them to get a new account once they are banned or better yet just match them up against other cheaters transparently. Eventually they'll get bored. While it does depend on how much access you have, I've seen some java applets that will effectively create a hash of hardware profiles similar to apples UDID, and then theres cookies. Matching banned account email hashes to strings in other login cookies wouldn't be too difficult either. Taking it to the next level, if you had an app running locally you could also peek at the process list. Looks like this might be a bit dated by now though.
