If the account has been compromised, the attacker is statistically unlikely to use it at the same time as the legitimate user. Detecting accounts used from multiple locations and reacting to suspicious patterns can be useful (keeping in mind that you need to manage the user experience on false positives), but specifically detecting simultaneous logins doesn't help.
Multiple logins from one location could be the user wanting to use a different browser (how likely that is heavily depends on how technical your users are). On the other hand, it could be someone actively sniffing on a wifi connection. This is especially relevant if your application's design makes it easier for a sniffer to grab the user's cookie than to grab his authentication data — but arguably if that's the case you're doing something else wrong, such as not using HTTPS for everything you should. Note furthermore that if the attacker is using the same browser behind the same NAT, you may not be able to reliably tell the attacker from the legitimate user.
Switching to a different location could be the user switching from one device to another (leaving home and switching to my cell). It could even be a mobile device changing IP providers (getting out of range of the campus's free wifi and switching to my 3G connection).
For most applications, allow concurrent logins and treat connections from unusual locations (not necessarily simultaneous) as suspicious. A notification (not scary (“you've been hacked”) or disruptive (a banner, not a modal popup), just informative) of prior and concurrent locations can alert the user; be sure to provide a way for the user to find out what he should do if he thinks something untowards is going on. A few applications such as banking should use stricter rules, but that isn't the norm.