I needed a way to prevent users from opening multiple accounts, so the best idea I had was to save their IP when they register and then check against existing IPs during registration.

Here's what I did.

In the start.php init() function of an existing custom plugin I have, I added:

// IP logging
register_elgg_event_handler('create', 'user', 'MYPLUGIN_log_ip');

Then, also in start.php, I had to define this new function:

   // Save IP address of new users
    function MYPLUGIN_log_ip($event, $object_type, $object)
    {
     if (($object) && ($object instanceof ElggUser))
     {
       $ip_address = $_SERVER['REMOTE_ADDR'];
       create_metadata($object->guid, 'ip_address', $ip_address, '', 0, ACCESS_PUBLIC);
     }
    }

Ok, so that's step 1.  Now the IP of every new user is saved as metadata.  The second step is using these saved IPs to prevent new accounts being added with existing IPs.

I'm using the Site Access plugin, so I modified the /MYDOMAIN.com/mod/siteaccess/views/default/account/forms/register.php file and added this near the top:

$ip_address = $_SERVER['REMOTE_ADDR'];
// find_metadata($meta_name="",$meta_value="",$entity_type=""",$entity_subtype="",$limit=10,$offset=0,$order_by="",$site_guid=0)
$ip_metadata = find_metadata("ip_address",$ip_address,"user");
 
if (is_array($ip_metadata))
  $form_body = '<br /><b>Error:</b><br />An account already exists for your IP address.<br /><br />If you feel this shouldn\'t be the case, please contact support</a>.';          
else
{

// normal Site Access logic

}

If you aren't using Site Access then I'd suggest you look at how it overrides the core registration form and mimic that in your own code.

So now I've prevented 99% of users from registering an account with an existing IP.  But I haven't prevented the "smart" haxxors that can spoof a POST or GET of an HTML form.  I've hidden the form but I haven't done anything to prevent someone from still triggering the action.

Rather than trying to override the core actions/register.php file (a hook wouldn't suffice because I need to prevent registration entirely, not just add a function after it happens), I decided to take the easy way out and just modify it.  So near the top I added this code:

// Validate IP already exists
    $ip_address = $_SERVER['REMOTE_ADDR'];
    // find_metadata($meta_name="",$meta_value="",$entity_type=""",$entity_subtype="",$limit=10,$offset=0,$order_by="",$site_guid=0)
    $ip_metadata = find_metadata("ip_address",$ip_address,"user");
 
  if (is_array($ip_metadata))
  {
    register_error("<b>Error:</b><br />An account already exists for your IP address.<br /><br />If you feel this shouldn't be the case, please contact support.");
    forward();
  }
  else
{

// normal action stuff

}

Hopefully that helps someone trying to do the same thing!  If anyone has a better method I'm all ears too.