yup its true, a lot of them are setting up special proggies too that login to your site via a set proxy and download away...one thing you can check is your raw log files to see if they are all using the same browser and identifiying themselves as the same computer (ie, their operating system, versions, etc). At least that will give you an answer to your question. Then run to Ray to get strongbox installed ;
cheers,
Luke