I do not like the idea of using IPs for that either, but since it's only for the timing instead of locking people out of the service, it's less of a concern.

And as db0 said IPs are far from optimal but they're the best thing that "we" [actually the devs] have available. If you have some alternative way to discourage simultaneous multi-accounting, by all means, suggest it here.

Same with people who use VPN per default.

That's the closest thing we have though. The alternative is just people using alts, and at that point might as well not have limits. There can be ways to add exceptions if needed.

If you undo the changes dome by a bot it could cause chaos. It is better to let users know it needs to be fixed.

It could cause chaos if done poorly, indeed. But I think that there are ways to minimise this chaos.

One of them would be that reverted pixels are marked as "reverted by the admins", and that appears in an overlay similar to the heatmap.

Also you could do some sort of proof of work to make it unfeasible to have a bunch of alts.

Like in cryptography? I like this idea. Perhaps it could be used when there's a reasonable possibility that two accounts are from the same user; for example same IP, or same username but different instance, etc.