The user can choose their time zone when they sign up, and the service can prevent them from changing it (or heavily limit how often it can be changed)

It doesn't matter if they fake it. They're only getting one window per 24 hours.

Problem: user goes on vacation three time zones west of their usual location, and now they can’t access the site tomorrow.

Worth it.