Yeah, it's not at all foolproof or even great. I don't think there's really a good solution that still provides true anonymity, since the only way to prevent box-stuffing is to actually restrict people to one entry per real person (and that generally requires a more involved real-world authentication process).