sadly the best way is to have phone/sms verification like most sites do nowadays to prevent bots.
a current user and future users must have a unique verified phone number attached to their account.
the roundabout way I see this not working is if someone uses their mommy's number to make a multi. so you'd also have to keep the IP tracking in place.