I would be surprised if this is common practice. They could expose themselves to legal issues depending on site terms.
If someone is savvy they can circumvent things however i'd suggest better safe than sorry and block source IP's and MAC addresses anyway. Not to mention detection for proxies. Lastly and this is just my personal preference I'd require Facebook login but don't display their info publicly so they can still be anonymous to the members or at least a Google login. I have mixed feelings about allowing simple user/email logins as there is some inherent risk in that although some may only want to use this type of authentication as they're concerned about being found out.