IP is not something I can rely on, because looks like they have enough unique IP addresses to use. And like you said, motivated and a lot of time on their hand. I feel like adding that 60 seconds delay only make the UX bad for genuine users.