Yes it can be done. It's trivial.
There are many ways for a user or an attacker to have multiple IP addresses - or to share IP addresses. Here's a list, off the top of my head.
This list is how one IP address may be used by multiple systems.
- Multi-user host. Many hosts are used by multiple people. by definition, they will all use the same interfaces to connect to your server, and therefore share IP addresses.
- DHCP. DHCP works by creating a pool of IP addresses, from which the client (the system that will eventually connect to you) is assigned one of the addresses. The IP address used by this system is eventually returned to the pool. At this point, someone else can pick up the IP address. If both systems connect to your system, they could each connect at a time when they possess the IP address.
- Manual IP configuration. Anyone can configure their network interface to use any IP address they want. A system could be intentionally configured to use an IP address in use by another system.
- NAT. There are networks that use Network Address Translation to show a very small number of re-used IP addresses to the internet, while using entirely different addresses within the network. This is extremely common. WHen clients connect to your server through NAT servers, they will all appear to come from the same IP address.
This list is how a single host can appear to have multiple IP addresses.
- DHCP. As described in the first list, the IP address is eventually released by the system using it and returned to the pool. When the system connects back to the network, it will be granted a new address, which is not guaranteed to be the same as the old address.
- Manual IP configuration. Anyone can configure their network interface to use any IP address they want. A system could be intentionally configured to use one IP address, then five minutes later use another address.
- NAT. NAT isn't required to use the same address the every time for the same client. A single client could connect to your server through NAT and be given a different IP address every time.
- Laptop roaming across networks. When a system disconnects from one network and connects to another network, it gets a new IP address from the new network. While there is a low probability of a getting a reserved locally routable address from the new network that exactly matches the reserved locally routable address from the old network, this is far from guaranteed. More likely, the address will be different. The NATted address is "guaranteed" to be different.
- Multi-homed machines. A multi-homed machine is connected to the network via multiple network cards, or to multiple networks with multiple interfaces. This machine, by definition, has multiple IP addresses - one for each interface. If traffic comes to you through one network one time, then the other network another time, the same host will connect using multiple addresses. This is unlikely, but can occur given the right network structure.
- Botnet. Attackers can rent or build a botnet. The botnet will, by definition, be constructed of multiple systems, each of which will have a different IP address. The attacker will have multiple IPs at his/her disposal.