Instead of sending a 403 Forbidden error to the end user, this would show the stolenimage.gif to them. It is a matter of choice on what the end result would be.
If customers use Norton Internet Security and Zone Alarm, those programs modify the referrer and that is why it will not work for them. They would need to enable referrer passing for your domains or make it pass a blank referrer. I have found that writing a help page describing the necessary changes in a step by step manner to cut way down on emails asking for help.
Code:
Content visible to verified customers only.