We've made an online action website where people can vote on things and the people with most votes win prizes. We thought it was a good idea to validate the us

We've made an online action website where people can vote on things and the people with most votes win prizes. We thought it was a good idea to validate the user by email (by sending an email with a unique link, that when clicked, the vote was authenticated.) We thought it was good enough as a "security measure", but we thought wrong! Some people made disposable email accounts and sent the emails to there, so there were some people with thousands of votes, while most only had a few dozen. When looking in the database, we were glad that we stored some basic info like IP, Agent Strings and timestamps. These people were smart enough to (sometimes) change IP's but then when looking to the timestamps and agent strings, we saw that these people were cheaters with disposable email addresses. We removed all these votes and the "winners" didn't win anything at the end, because they had much less votes than "normal" players. They started sending angry emails to the customer, and did not leave them alone. We are currently making another action for that customer, but this time we have added browser fingerprinting, that checks a lot of variables (like fonts, canvas rendering, webgl, screen sizes, number of monitors, device pixel ratios, ...). This way we'll going to identify cheaters much easily, ... BUT you can still spoof it, so it's never a foolproof method of identifying users, it just makes our lives a little bit easier when there's some cheating going on ;) // EDIT: some typos