Use a hash of the access log as an additional kind of password. The access log (Computer/Access Time/Access ID) is known to the client and the server. Intruders would need to listen and record the communication from the beginning.

Depending on the way the client computer gets identified, the ID could be copied (copies of the GUID, copies of a virtual machine,...)