trick bots

[menklab]

Obvious solutions: rate limiting, false responses
Rate limit: only allow X requests per IP per minute/hour
False response: If someone requests an ID that doesn't exist, instead of throwing an error which allows the bot to quickly move on, you deliver a page that looks like any other request, except when they request the file its a dummy. The encrypted data are complete gibberish. Furthermore, if you severely rate-limit the transmission of the dummy files then the bot is hung up waiting for download to complete.
Random file name (and length) and content in file.