Logging and alerting the user that their account is being used from a new context and requiring reauthentication when accessing the account from an unfamiliar IP/user agent would mitigate this to some extent.