Theres a few tricks that can be done to rate-limit both bandwidth and the number of requests for files, thought be careful with how you set them up. 1 download per IP rules suck when they don't discriminate between real users and users forced to use proxy servers.

Another idea would be to put in one of the many "prove you're human" systems. Feed the actual file through a php script to avoid giving away the actual location of it, and that should cut almost all of the bots out.