I do not accept submissions from the same IP with frequency higher than let's say 5 mins.

You cannot assume that a single IP address represents a single user. Perhaps with IPv6 that will be true, but it's not at all true for IPv4. A cookie or some other form of session data is much more reliable -- but beware that malicious clients may refuse to return your session data or may return stale but cached session data.