Any hardware address can be spoofed. If a person is really adamant about getting around a ban like that, they will.
The only 'effective' ban is an account ban, which requires an authentication system. The downside to the mod being free is that people will just register multiple accounts.
Therefore the most effective way of banning is to do it by multiple addresses: IP (subnet if needed), network card mac, cpu mac, HD mac etc.