[eluser]InsiteFX[/eluser]
If you are using an Auth system, you could always get the users browser and ip then do a host lookup and reverse lookup to make sure it is them.
My old Auth system had a vistors and active users database table in it, when anyone came to the site they were added as a guest, then when they loged in the were added to the active users table with ip and deleted from the active guests table.
I will be converting the old auth over to CodeIgniter soon, I have been looking at changing it into an RBAC Auth system. I have the database tables already designed.
Enjoy
InsiteFX