We just dealt with one guy that just voted 2800 times from the same IP. Deleted the rows, and made it one vote per IP.
It works because to see a Yes/No it depends on if you have the cookie set, but to actually vote it checks the IP.
So if someone legitimately votes from a multi-user IP that already was used to vote, it'll show a Yes/No, get sent to the vote page, but won't go in–but it'll seem like it did :)
What's the solution to this? No matter what you do, without a validation system (eg: verify email, credit card, etc), there's no way to differentiate between people.
It works because to see a Yes/No it depends on if you have the cookie set, but to actually vote it checks the IP.
So if someone legitimately votes from a multi-user IP that already was used to vote, it'll show a Yes/No, get sent to the vote page, but won't go in–but it'll seem like it did :)