If they have a skillful and attentive server administrator, they can set it up for one download per password. They probably won't use an anonymous download (which is a wares-dude magnet), but if they use the same password for everyone, they can't track who passed it along to the wares-dudes. My guess is that they probably don't waste time with security because they know that some of the users will e-mail the exe or zip file to their friends anyway, so there's no way to stop it without a Machiavellian (or should I say Gatesian) WinXP hardware registry lock.