EWinner's IP argument is reasonably strong. The IP addresses in the three groups correspond to Oklahoma, Texas and Canada. Within each group, there is reason to suspect duplication, HOWEVER, Ewinner has NOT made the case that the three groups of accounts have anything to do with each other.
Now, Ewinner mentioned something about NYC and RhodeIsland. Clearly, none of these accounts are from those locations.
A reasonable conclusion is that there are 3 different pairs of people exceeding wager limits.
Now, since EWinner would have kept any losses, they should pay any winnings. As for bonuses, each pair of duplicate accounts should be considered as one account for bonus purposes.
The players can be kicked out or have their limits reduced to something very low.
Now, as strong as the IP address argument is, they do really need more details like login times, etc. When I consulted for Casablanca, we frequently used IP addresses, login times, wagers, amounts, false addresses, and even browser information to make these types of determinations. I think in one case, phone records from the 800 number were examined against call times.
The point is, there are ways for EWinner to identify the players in cahoots (though not all that detail has been presented here). Also, there should be some standard remedy: loss of bonuses and future wagering privileges.
Confiscation of winning is not really proper. There is no way to know if EWinner was already aware of the duplication but hoped the players would hit a losing streak (or if the players had just recently come out of a losing streak).
EWinner needs to be more careful about players with high limits and checking betting patterns BEFORE it becomes an issue.