We have a service where we literally give away free money.
Naturally said service is ripe for abuse. To defend against this we do the following:
log
I think only way is to bind your users accounts to 'real world' information, like his/her passport number, for instance. Of course, you'll need to make sure that information is securely stored and to find some way to validate it.