First, establish a wildcard DNS domain (*) for your site's IP address. That will allow anystring.yourdomain.com to resolve correctly.
Configure IIS to bind to a dedicated IP address, but not to rely on host headers (have an empty host header). That will cause all HTTP requests for the bound IP to be directed to your site.
Have an HttpModule that looks at the incoming domain (in HttpContext), and rejects it if it's not valid. You might consider setting a cookie or ticket or something like that, to avoid the need to do a DB lookup for each request in order to validate it.