I'm hosting an online singing competition that's at the finale 2 contestants with a cash prize over $10,000 plus a duet with a well known artist in that genera. What we found was that 2 of the finale 4 contestants found a way at to multiply their votes dramatically on the semi finale round. They where between 15k-20k votes while the other 2 barely pushed passed 3K votes. Needless to say I warned them they continued and are no longer in the contest. This is the first year doing this contest and were looking to incorporate stronger security measures been that the prizes will be higher every year. More importantly than the money we are trying to run a new platform with a good reputation. We don't want to scare people away from voting but we want to minimize the fraud.
I'd use, in addition to standard IP limiting, recaptcha or some other proven captcha system. What they most certainly did was/or found someone who could script your voting API and just churned out votes. With a captcha, and a strong one at that, each voter would need to prove that they are at least human. Google's recaptcha is great because it heuristically decides if the user is valid and so normal people (aka people who have Google accounts..) can just click the fancy checkbox and be good in three seconds. There have been some recaptcha attacks but really they're slow and experimental.
Vote fraud is so difficult that even all the governments of the world haven't been able to solve it. Since you can't jail people for fraud you need to make it as difficult as possible to automate votes. There's really no easy answer beyond "throw a captcha at it". Maybe you have some vulnerability where they were able to modify the vote table directly? Very open ended.