Yes, perhaps the most reasonable approach is to tie these restrictions to the specific device (and, where applicable, account).

The ban doesn’t need to catch every single case, it just needs to add enough friction to stop the most frequent and destroy network effects.