you could put a 'logged in' column in the table that holds the user information... as the user logs in or out, column would toggle, etc.
For the 5min rule, put a 'last_login' field in the same table...fill it with a timestamp each time the user logs in... in your login script, if less than 300 seconds has elapsed, the login fails.
I'm not sure if this is such a good idea, though... what if a user logs out accidentally, or 'gets logged out' by some system problem on their end... IE gets confused and quits, or something. Then, they have to wait? That would drive me nuts! My $0.02.