For something physical, specially something run by the government, you can ask people during account creation for some identification like full name + date of birth, not allow duplicate accounts to enter the same raffle, and check the id of the winners when they get there (so you don't have companies creating bots).