I would assume they keep logs of downloads vs. IP address, so at least they can take legal action against the thieves whose IP address doesn't match that of the legit purchaser. However, they are apparently not even taking the simple steps of limiting the original download by time or valid IP address. Not very professional, in my opinion.