NFT Collection Limited to 1 Mint

This mapping was added to track mints to a wallet

/// @dev Address => has minted => whether the address has minted a token.
    mapping(address => bool) public hasMinted;

_mintTo checks if this address has been mintedTo before and if not, allows the mint & then adds to the hasMinted mapping

/// @dev Mints an NFT to `to`
    function _mintTo(address _to, string calldata _uri) internal returns (uint256 tokenIdToMint) {
        tokenIdToMint = nextTokenIdToMint;
        nextTokenIdToMint += 1;

        require(bytes(_uri).length > 0, "empty uri.");
        // require that the user has not minted before
        require(!hasMinted[_to], "user has minted before");
        _setTokenURI(tokenIdToMint, _uri);

        _safeMint(_to, tokenIdToMint);
        // Mark that the user has minted
        hasMinted[_to] = true;

        emit TokensMinted(_to, tokenIdToMint, _uri);
    }

This is vulnerable to sybil attacks.