I guess one way of doing this is creating a symbolic link to the directory which really contains the files.
Every day in a cron job,:
- Create a new symlink to the directory with some hashed name from the date
- Remove the one from the day before yesterday
Then you'd have two symlinks existing at any given time, today's and yesterday's. People won't be able to have permanent links to stuff inside your downloads directory because it will keep changing.
You also need to stop people accessing the files via the true downloads directory, but that can be done easily with Apache's configuration.
Mark
NB: The symlinks idea goes a bit wrong if you're not on Unix 🙂