Ok, understood. If you are not going to identify the user then you will need to have some other identifier so the user only gets the items they have paid for. You can use the stored order id and compare this to the session order id that is present. So the recordset would be about the same but you would want to filter where the order id matches the current order id and make sure you check that the transaction was successful.
Other than checking on the order id rather than the user's id the rest of this will be about the same. You would query your db where the item id matches from the items table and join the orders tables then filter on the order id and the status of the order. This should give you a recordset with the record of an item, you can use these recordset values in the download server behavior.
