I would think you use a combination of IP address, browser fingerprint, and machine fingerprint.

Much better than cookies, because the user can't delete anything. Plus the fingerprints would still work across browsers (I think).