I have a solution!
1.) IP Ban, though as Pandora said, that's not hard to bypass. Then again, not every RO player is savvy enough to get around this.
2.) Make a new rule stating "Any players logging on to any secondary or tertiary accounts owned by said player will have that account deleted."
Harsh, I realize this, but if you clearly state this in your rules, they'll take it pretty seriously, and will be hesitant to log onto those accounts, making the problem almost non-existant.
Though, that doesn't mean that deleting said account will be a walk in the park, especially if you have a large SQL database.