Some conceptual thoughts:

1. You want the content to be user-specific.
Indeed, you really even want it to be order-specific.

2. You want security around it.

3. You want a way to administratively upload the content and advise the customer that it's available.

I suggest writing code to expand the order-data components to allow you to store the proof as binary content into the database (uploaded from the Admin "orders" area). From that same screen you can tell the customer that the order is updated and awaiting approval.
Then you could expand the customer-side order-history screen to allow them to accept/reject the proof and add comments if needed. Either response could trigger an email to you as well as update the order data.
Then you can continue order fulfillment as needed (or repeat by uploading another proof, either replacing original or adding another, plus email).

If I understand what you've described correctly, that's how I think I'd tackle it. Not a small task -- will take a fair bit of time to implement. Time to brush off those PHP manuals ! <grin>