What is the best way to "lock" a process?

Here is the scenario...
An authenticated user can earn points and later spend it on some items.
Each item has fix value for each entry, where user can spend for that. For example user has 100 points and an item needs 40 points for each entry. User allows to spend as much as points he wants for an item, which in this case he can spend max 80 points and get 2 entries. 
The problem is, there is a chance that a user try to spend more than what he is allow by logging in from different browsers or computers and add these entries at the same time. Although there is server side validation but there is still a chance that he passes the validation.
The work around was to restrict user to login only once which is not feasible solution.
Put a lock on static object and make sure it will not tampered by other threads. But what if 1000 users or even more want to add an entry at the fairly same time? I don't want make user wait so long...


Wh ...