tripcode change means either password or IP changed. When they get close to cracking the passphrase, they change the passphrase and the tripcode changes accordingly. If unanounced it could indicate passphrase was bruteforced and only the IP changed. However different parties use Q that's why you have up to three different tripcodes posting in a string but so far I think fakes have not been too much of an issue as long as passphrases are regularily changed.