Not IP addresses, devices! Even if multiple users use it, the innocent user can check a "multiple device" box. That way, if a user is banned, they can't use the innocent person's account, because of password. I know this sounds crazy, but Google login will be off for multiple user devices. That way, banned users can't login. Should the innocent user use Google login, they will be given a password that shuts off in 2 minutes, meaning they should have enough time to memorize it, while the banned user can't find it!