The only option I know that is resistant to header snooping (DownloadHelper, Live HTTP headers, etc) is by using RTMP streams, which is a true stream rather then a play-as-you-download stream.
– en.wikipedia.org/wiki/Real_Time_Messaging_Protocol
I don’t have any experience in deploying rtmp myself, but I know there are multiple solutions out there for playing, like flowplayer:
http://flowplayer.org/demos/plugins/streaming/multiple-rtmp.html
I know MySpace switched all their artist playlists to rtmp and it’s kept basically everyone out – although we can always record the output of the player using desktop software like Audio Hijack Pro:
www.rogueamoeba.com/audiohijackpro/
All this being said, I have seen a commandline rtmp stream ripper, but never got it to work. In the end the best protection is minimum quality rtmp streams.
Hope this helps!