What we used to do was check the IP against a variety of things beyond the internal tool that lets you look for multi's, for example doing a blacklist check, checking the geolocation of the IP against any details of IRL location they've provided, running the IP against a list of known trouble makers in NS - pornspammers, GCR coupers, trolls, etc. I also checked the history of the nation they've provided using NSHistory and, where they've provided a history of past regions, spent some time looking over it and those forums, searching for any history of forum bans, bad behavior, etc. Where I found details of past aliases or other nations I tended to run similar history checks on those nations as well. Generally speaking I was looking for any inconsistencies between the information they provided and what I was able to find out.

Different admins ran checks in different ways, using different tools and of differing thoroughness. I was probably the most rigorous. But using the inbuilt IP tool alone is not very rigorous at all.