Consider using federated user authentication from some social network like Facebook or Twitter. You can suggest to your user that your use of social credentials is a service to them, saving them the hassle of remembering and maintaining a different username/password set for your site. Should they change their password on the social network, your site would automatically respond only to the new password. Look into OAuth as a method for accomplishing this.
As a side effect of using a social network as your security user-base, you get the freeloader protection you are looking for. Most people only have one account on each social network. The social networks already use most of the techniques you mentioned above to avoid their own freeloader issues. You will still need to track which users have already received a free week, but you can offload the freeloader detection issues to a social network for free.
As an additional side benefit, you can also get your users to advertise for you. i.e. "Let us post a comment about your using our software on your facebook wall, and we'll give you a week of free use."
-- edit to reply to comments --Edit to Reply to Comments
Some oAuth hosts, such as Microsoft Live Accounts have not advertising outlet and have a more professional, business-like feel than the consumer social networks. Admittedly, getting multiple Live Accounts however is pretty trivial, so there is a trade off.
I'm not sure how trivia getting a second FaceBook account is. I think they ask for and test a phone number during the registration process.
I've got another idea that might help you, but this answer has already gotten very long, so I'm going to start another answer with the new idea...
