which is why you need a script to handle the downloads.
I have designed several sites for clients which do precisely the same things as yours, and in each case I've used a custom-written script. In essence the script only allows a customer access to a specific download directory or file if he she comes from a specific url. If you buy a file called images/alpha you are directed to that file by the script, and to that file only. If you type images/beta into your browser you'll be denied access, because you aren't coming from the right url for images/beta.
That's a very basic description of how it works, but I'm sure it's enough to give you the idea.