I guess you could send them a link to the download page that includes the order number as a querystring variable. Then on the download page, create a recordset to filter the orders table ordrID column by the querystring variable in the link, and filter the orderDate column on the currant date.
I wouldn't consider this very secure however, someone would be able to download with out purchasing just by guessing an order ID number. Since you are not having the customer log in, it is impossible to have a secure solution.