To the orig question. As biker suggests, there is nothing stopping a determined user from signing up multiple times. IMO you have to make the auotmated attack harder or more expensive (either time/money).

Unfort the flip side is, if you make the signup process too hard, you'll get no legit users... :-(

good luck, I'd be interested to hear about what you come up with.