I think this regular expression would work:
/^\d{1,3}( \d{3})*$/
Usually you would do something like that by requiring them to register and log in first. Then you can save the userID with the order so that after the purchase you can return a list of purchased products for download.