It sounds like you're starting with an assumption. Before going any further and risking over-engineering, I would take a moment to challenge that assumption.
I would take a step back and understand your business requirements.
- Is there a security concern with letting your user change his name, letting him impersonate different people constantly?
- Is the user name just complementary information like a screen name because other users access someone's data through a shared URL?
- Are there billing issues that occur when the name isn't the same month to month, and doesn't match credit card's records?
- Are there use cases where these name changes are appropriate? What if a user is trying to escape cyber bullying and keeps getting found? Or worse, an abusive partner?
Then I would ask if this is a real problem. Hopefully your system logs can tell you.
- Are users constantly changing their name?
- Are we really just talking about one user that did it a couple of times?
Once you have the requirements and context I would start evaluating solutions.
- Are these people abusing their terms and conditions, should they be reprimanded?
- Is a solution like Facebook's appropriate?
- Do you just need an audit log of name changes so that if a fraud case comes up you can back-track and find a user's alias at the time of a given interaction?
What's the user experience for each solution? The cost to you? And are any a significant improvement over the status quo?
As for restriction, if after all that it is still the way to go, then I would simply make sure to set the expectation in your sign up and editing forms, so that users are clear about the business rules behind name changes. It could be as simple as one short line of text alongside the name field.