[Hellcat]

You could make a script that redirects via HTTP headers, that way the real location will not show up in any sourcecodes, but it's still possible to find out!

Another option would be a downloadscript that sends the file to the browser but does a refferer check before sending (and/or checks if the user is currently logged in to the forum) and it gets the files from a directory that's not accessible from the webserver.
Remotelinking is not possible that way - I'm using such a script on some of my own sites.

The above could be done with a simple .htaccess as well, but the script is more flexible