You could require users to register their wallet before they start to receive the faucet. Then drip a larger % to those who register. Or start dripping new wallets slower and run checks for ip changes. then just drip a small amount like .1 FIND to wallets with ip's bouncing all over the world. You can run tons of IP checks and run a scoring algo on the wallet before giving out the coins. There are many circumstances where IP's will change, and while a wallet could be hit if someone travels or whatever, a scoring algo could reinstate them later on. The key is maintaining the proof of faucet concept by consistently delivering coins, but not to the wrong people. No matter what you do, the ratio of downloaded/opened wallets will never match.
Or just use something like maxmind for risk based order fraud detection, they take parameters like location, residential/enterprise ISP, open service ports like http, proxy etc etc. People on tor will be doomed though, as well as everyone running wallets on VMs.
Do you thing that VM falls from the sky? If you did, ASIC miner would also be.