Beatnik:

I don't think your solution would work (though it's one I considered) for AOL users, who I'd still like to be able to sell to. Have you ever looked at the access logs from AOL users? AOL does some screwy things with IPs. You can't rely on an IP from AOL.

This would also flame out in the case of shared computers, like at a university or corporation. If a user accessed my site and added/edited their shopping cart, their cart would still be available to the next user if they didn't log out or close the browser, if you used the IP for verification.