I'm assuming it's a "session based address". This begs the question how you determine which download a payment is for. Could you elaborate on that a little?

May I ask how you do session identification?

This is interesting both for privacy reasons and for evaluating possible gains from referral program

At the moment, the service is monitoring a single bitcoin address. This wouldn't work for many retailers who sell items that have a set price. The reason it works for me is that the price that I charge per download is pretty much unique to each user. The cost is calculated at 0.1 btc / GB, and rounded to 4 non zero digits, meaning that unless two users simultaneously request a file of the EXACT same size, it doesn't matter. The price itself is what I am currently using to identify users to successful payments.