Cleo used trafficguardian.com (which went down a while back and appears to be down currently). It was an apache module which checked in with the mothership every time apache was restarted, and when their domain was intermittently unreachable, it would pull her server down until the module timed out during log rotation.
That withstanding, the module itself did do a fine job of doing precisely what it was supposed to do. It used shared memory to keep track of IPs that had hit the directories that contained content, and, if an IP wasn't in the list prior to the request for the .wmv (or any protected content for that matter), it would redirect or deny (can't remember) that surfer's request.
It was pretty easy to install, a pain in the butt to get configured the first time (though the author did spend a bit of time getting it working to Cleo's specifications) and it was pretty much fire and forget.
.mpg does send a referrer during a request most of the time, however, .wmv does not which is why most .htaccess rules don't work.
Cleo's test request