mac addresses can be changed.

You could make it harder by using a username and password, and requiring people to register via email. That wouldn't solve your problem, but it would help make it not worth their time.
You could also block known TOR exit nodes.