You are asking the question most of the ad and tracking industry has been trying to solve for centuries. New ways emerge all the time, and browser manufacturers and browser-plugins try to prevent them, however only trying to catch up all the time.
Things you can use:
Of all of them, using a browser fingerprint seems to be the best solution. You can check out Am I Unique or similar sites to get an idea about what things you can check against.
Remember, though, that the above techniques only work in a browser. As soon as someone writes a bot or uses Postman, they won't protect you. Except for the IP maybe. You may want to only allow a certain max. amount of votes from one IP per day in order to prevent miss-use to a degree.