Be sure to read this too:
http://phpbuilder.com/columns/tim20000526.php3
For instance we'll say that all your media files are in the /media directory. You'd add this to apache:
<Location /media>
ForceType application/x-httpd-php3
</Location>
then create a file named "media" with something like:
<?php
if (!$HTTP_REFERER == "www.example.com")
{
header("Location: www.example.com");
}
?>
Obviously you want a script more complex than that, and you must be careful of the fact that some browser's falsify the referer, and proxys often don't set it, and it's only ever present if someone clicked a link to your site.
If they have a program like Proxomitron they can just enter the referer they need to have, so do be mindful of that.
But that should thwart the majority of people trying to steal your bandwidth.