No, you wouldn't need 2 hosting accounts; just one hosting account and one file sharing account.
You would know the number of downloads the same way you know them now, the cart keeps track of how many times the customer has accessed the link.
As long as the actual url of the download folder is never disclosed to the customer why would this be a security problem? Why can't the symlink point to an external url instead of an internal directory?
As for a larger plan, no, its more cost effective to have a small hosting account and a cheap file sharing plan.




