prevent password (account) sharing

[MattR]

Would you have to enter annother column? I would think something like this:

every time a page is requested:

SELECT count( * ) AS number
FROM session
WHERE userid = $bbuserinfo[userid]
     and lastvisit > $browsertimeout

if( $result[ number ] > 1 ) {
  update user set usergroupid = some_id_for_dup_user_acct
  where userid = $bbuserinfo[ userid ]
}

this would then block the account and at the end of the day you could look at the users in that account, perform reporting, etc.

Or if you wanted to be tricky, you could alter the UPDATE SESSION query to ignore IP and just user USERID..
UPDATE session SET blah
WHERE userid = $bbuserid[ userid ]

then check mysql_num_rows_affected (or whatever the function is). If it updates more than one row, you have two userids in there.