IP addresses and mac addresses do not uniquely identify people. Most home internet users have dynamic IP addresses assigned by their ISP, so it changes over time, and some ISPs even assign a different one every single time the router is rebooted (ie: Orange). Even with a static IP, nothing prevents anyone from using a VPN, tor, or any other anonymity tool. IP addresses may also be shared: some schools, dormitories, and organizations have a single address for every single computer on its network, so you could end up mistaking hundreds of people as the same person. Some computers themselves are also shared (ie: with coworkers, family members, friends, …). As for mac addresses, they can very easily be spoofed, and one could even make a script to change their mac address every minute if they wanted to... so yeah, that's a bad idea too.
If this still does not discourage you from using mac addresses, feel free to add this "feature" to Hercules: https://github.com/HerculesWS/Hercules/issues/1734
There's really no silver bullet to really be sure of the identity of someone, but one of the approaches that kinda works is to make abuse costly on abusers, while not imposing a huge burden on non-abusers. What works best is doing a physical verification instead of a digital one when someone creates an account. For example, most social media platforms now ask you to provide and validate a phone number. This means if someone were to bypass this verification they would have to have more than one phone. Some sites, such as Paypal, go even further ask you for your credit card number (or bank account number) and then do a transaction on it (usually $1), to see if the card is valid. This means you would have to have more than one credit card if you want to bypass this verification, which implies physically going to your bank, making an appointment, and opening a new account. Some (such as Google) prefer to snail mail you an envelope containing a code, which you then have to enter on their website. To abuse this you would need more than one street address. Keep in mind that this only makes it harder on would-be abusers and that nothing can 100% fingerprint someone. Even DNA profiling isn't perfect.