<p>How would you ensure that only one user is logged in per account at a time?</p>

<p>Assuming cookies are persistent.</p>

Typically the best way is to implement a customization on the provider that checks for last login, as well as adding methods to your code to keep track of user action.
The key is that you must know at what point did the user last do something OR logout.  From there you can determine if the account is actually ready.  If you setup the tracking for these elements in code,  You can then modify the membership provider to check to ensure that the account can login.