Just some ideas...
The client can't be trusted, so cookies are right out, imo. The logic for checking ip's agains a database is pretty trivial.
if(ip is in database) {
tell the user he's been bad
}
else {
add ip to database
register vote
}
The most tamper-proof thing to do is to require some sort of login before the users can vote. This gives a bonus of being able to store voting statistics, which might be intresting.
