The obvious answer is cookies plus IP address.
However, as you say, IP addresses can change and cookies can be cleared by the user.
There are in fact a whole load of ways to determine information about a user's machine, ranging from the browser ID to detecting the list of fonts installed on the computer. A recent experiment managed to show that without using cookies, it was possible for them to detect unique computers with quite a good degree of accuracy.
However, it's highly unlikely that you'd need to do all of that -- most sites that do this just use cookies, and live with the fact that they can be reset. After all, if the user has cleared their cookies, they are expecting sites to forget who they are.
Also, pretty much any technique you use to identify people will be perceieved as an invasion of the user's privacy (even cookies have this image for many people, because of abuse by advertising companies, hence why browsers allow them to be cleared).