I just happened to run into something today that might help you - Download Sentinel++. It's a PHP-based download manager.
From the site:
This is an Anti-leech, download limiter / file manager, that uses tokens to verify downloads instead of HTTP_REFERER or IP which can be spoofed or changed. Good coding practice with modern PHP security. XHTML / CSS valid output. Easy to customize with html templates. Usage is dead simple, the included and auto-installed web page does everything for you. Extremely easy to manage all of your download files and very easy to work into your existing web page. Uses flat files so no need for an additional MySQL database.
^^^ oh boy dont use php based download managers! php leaks memory
Sort of. Technically, it doesn't (as far as I know) leak, but it doesn't give memory back either. I use Apache's MaxRequestsPerChild to keep this under control. (It restarts the individual Apache processes after serving a certain number of pages.)
and will never be as efficient as the webserver that it runs on top when serving files
Well, no, but if you want to do something that your web server doesn't do, you need something other than your web server.
i found lighttpd to be alot less resource (cpu and memory) hungry than apache when serving files
Not that that is hard.
If lighttpd does what you need, that's probably a good way to go.