This will require an app, since for privacy you cannot compare customer records in liquid which is used for the front end. There are address verification/validation apps on the apps store but those lean towards ensuring delivery by minimizing shipping mistakes and not meant for preventing purchasing.
For @hikroo 's post about salesforce/hubspot or other third party CRMs this is something you need to bring up to those services support.
Each platform has apis but you’d need to research if they can: compare a new address to ALL existing order addresses and/or do so with a shrinking margin of error against even subtle changes i.e. adding Apt #A to an address, spelling street instead of Str.,etc
And then that needs to further connect to shopify to cancel/flag orders if your not doing so already through those third party UIs.
Fastest and deeper root problem fix ,for the business ,is to just set a purchase amount threshold, or other metric that offsets the cost/risk of samples so it doesn’t matter how many samples someone wants for “free”.*Also see subscriptions with the first order being free
.*Let them get as many as they want to the point they start giving them away free for you to their local social circle.
After all there must be a factual ROI attached to these free samples that either necessitates continuing to offer them, or clearly indicates they are a marginal/large drain that’s continued only for the sake of some tradition or a business delusion assuming they are worth it.
tl;dr Business is doing X but they need to prevent X from happening at scale, so why do X at all? Growing pains indicate a change of clothes is needed after all.
A super fast fix, but extremely cynical route not easily swallowed, is to just require government ID. There are plenty of ID verification apps/services available.
A more manual free fix for big abusers can be done using shopifys own fraud filter app to flag orders by address.
A scriptable automation app like usemechanic could build an index of addresses to then quickly reference for auto-rejection or tagging https://apps.shopify.com/mechanic. Contact me if you want to explore such an approach.
A robust fix would need an app that can disambiguate, fuzzy match , addresses to be unique to prevent word attacks subtle changes being treated as completely different addresses as noted above(str vs street). Or outright integrate to a service for address verification, or geoip.
A streamlined custom solution could be done using the carrier service api which would stop those orders at checkout time itself instead of having to wait for it to complete as an order.
The slow deeper root problem fix in a shopify perspective is account merging based on address.