I'd imagine that your Steam account will keep information about which games you have bought or downloaded. Logging in to Steam at a different computer surely wouldn't allow you to download the game again without paying. There'd always be problems with piracy.
But then there's a problem if the installation becomes corrupted or u need to format your computer...
Even if they do it how stigmata suggested, surely hackers would still be able to get around the IP checkers? I'd have thought the only possible way to do it is not release retail products over Steam. Buy them in the shop, and make it compatible with Steam for patches, but not to download and purchase the full piece of software.
If the installation gets corrupted, you just download it again, since Steam will have kept your IP in its database, and knows that it's really you downloading it again.
And I think that, with some ISP's, you have 2 IP addresses; the internal and external. Hackers might be able to change the external to match a friend's IP and then use his account to download. But to nullify that Steam can always record both the internal and external IP's.
Internal / External IPs, what are you talking about????
Internal LAN IP as opposed to External Web IP - is this what you mean? If this is the case, Steam will only see the External IP anyway, so this doesn't change anything?
It needs to be 100% secure otherwise Valve will lose probably double the amount of money they normally would with people pirating their software. I mean it is inevitable, but unless Steam's secure it may even be more so.
Now I'd admit, I've used Kazaa to download software before, but I'm talking pieces of software that not many people can really afford like MS Office XP Pro and back in the day 3DS Max etc. But I really don't agree with ripping off games companies, especially not Valve. I don't care if HL2 costs £100, I'll buy it.
You can't spoof an ip adress. That's impossible even for the best hackers. Because your ip adress is the adress the packets of data are sended to. So even if you spoof the ip adress, the package won't be delivered to your computer.