It only works if the account is hard-tied to something valuable and verifyable which uniquely identifies its owner.
Things that don't work:
IP addresses
These are neither unique (think corporate firewalls, internet cafes, reused dynamic IPs on mobile networks, proxies, etc.), nor constant (many internet connections have dynamic IPs, especially mobile). An IP check is also easy to circumvent: most people these days have at least two internet connections available to them (mobile and home, or home and work, etc.), and if you don't, finding a suitable proxy service isn't hard at all. Those still on dialup can just close and re-open their connection, which usually gives them a different IP address. If all else fails, Tor provides a steady stream of ever-changing IP addresses to use.
Cookies
These are ridiculously easy to circumvent - just clear your cookies, and you're good for another fake account.
User agent strings
While user agent strings are interesting bits of information these days, and close to unique, they are just as easy to spoof as cookies and similar information.
Other schemes that rely on the absence of something
All the above have in common that they verify that something does not yet exist, which is easy to bypass by simply removing or changing the thing you're checking against. Whatever you come up with yourself, if it checks that the user does not have something, it will not work. It's like trying to restrict access to a theater by giving everyone who has already been a ticket, and then refusing access to everyone who can produce a valid ticket.
Other services
You could use an account at another service (e.g., OpenID, Facebook, Twitter, etc.), but then you're just shifting the problem - if people can create fake accounts at your site, they can do so at another. E-mail doesn't work either: setting up fake e-mail accounts is just as easy as setting up fake twitter accounts, if not easier, and the world is full of throwaway-email providers.
Things that might work
Paid accounts.
The safest way is to turn your thing into a paid service; if people have to pay for their accounts, they can't just open dummy accounts. But most likely, you don't want that.
Real-world identification.
Tie accounts to real-world objects. Cellphones work well, as these cost money and can be verified by sending text messages. Credit cards work, too, but they increase the trust threshold - people won't just give you their credit card data as willingly as their cellphone number or e-mail address. You'll also be subject to more restrictive requirements on your end. Passport numbers and social security numbers would be great if only you could verify them; but most likely, you can't. Snail mail would theoretically work, but it would make for a cumbersome registration process, and I'd expect it to scare more people away than what you'd win through the promotion.
Valuable accounts.
If your site has some sort of 'karma' feature (like reputation on Stackexchange, or karma points on reddit), you can limit the promotion to accounts that have collected a minimum amount of karma points, both on the person spreading it and the new account - for example, a new account may only count after collection 100 points, and only existing accounts with 1000 points or more would be eligible. This way, building a large number of harvesting accounts would take a lot of effort, and if your karma system actually works, exploiting the promotion only makes your site better. Similar mechanisms can be used for sites that involve content (e.g. a minimum number of uploaded pictures, etc.), but you have to be careful - people can just upload anything, so just the fact that there is content is not enough to make it valuable.
