How can you even HAVE duplicate username / password combinations for different persons? I'd say there is a design flaw?
Anyway.. You could keep track of logged-in users in a table, which is updated every time a user load a page. After $timeoutSeconds the person is considered not logged in, so if a person logs on then with a username/pass it get acces. Otherwise display an "You are already logged in" message.
You could even keep track of IP addresses. This could be used to allow a user to log himself out, from an other window.
J.