Hmmmmm. This is something I hadn't thought about, having not really tried to bust a hidden item. I had just accepted that it was hidden. Silly me.
I really don't have a good answer. But, I have a thought, usable or not ...
Since SL must communicate to the client the real URL value, and that leaves a hole for trickery, I would suppose there would need to be a more secure method of passing the info to prevent that .. and LL won't be doing that soon.
So, the only secure way I can think of is to pass the URL by IM to just the people there and have them put it in their own Winamp or whatever player to listen. Then get a new stream every month (or swap out between several).
Like I say, may not be workable. But, then, maybe just changing the stream URL periodically is the most workable way to keep MOST people honest. But, if they noticed it not working .. they'd just go over and hack it again, I suppose.