hahahaha You're sneaky. Cookie attatchments to emails? Of coures I'm SURE it's been done before....

I'm not so sure that only allowing one download is really that important. Technically, once they have the download, they can redistribute it. So, having the same person able to download it multiple times is sortof a moot point.

I think the easiest way to prevent major hackzors from getting a foothold is to go with what you suggest, if you're selling individual downloads, then create seperate folders for each one, password protect them, and then just change passwords every so often, depending on your site traffic. AWStats is great for this in CPanel. If all of a sudden you see a bunch of downloads hitting from one particular site, follow the link back and you'll see what's going on. Fix it by changing the password for the file, or move the file to a different location.

Give 'em the old 404, if you know what I mean.

Paul