A user is defined by an irccloud account. Each irccloud account has a unique ipv6 and unique "user" name when connecting.
IE: sid655585@<unique_ipv6>
or: uid555512@<unique_ipv6>
s = subscriber, paid member
u = unsubscriped, free member.
It's possible, of course, to use this service to register many names and launch a spam attack using it. But, in that case you can just block all `u<star>@<star>.irccloud.com`[0] (assuming you can rdns properly)
Like I said, I'm not a super large advocate of irccloud, but just as webchat passes on the originating IP via cgi module extensions, irccloud fixes problems with abuse for operators.
I know this, because I have been running a large irc network for over 10 years.
[0]: I tried everything to make asterisks appear, but hackernews is doing something funky:
u*@*.irccloud.com