ytswy - 11:24 am on Jul 22, 2010 (gmt 0)
It's a long shot, but if you capturing the browser's user agent (if not, then start), do some analysis and see if it's the same one (or a group of ones) being used. That might indicate the same person/group doing all of these. If so, maybe you can flag orders with matching user agents for manual follow-up.
That's an interesting idea - if they are using a limited number of machines you could do some fingerprinting [arstechnica.com] using all the information that the browser will give you.