Unfortunately that would not work in this case: in this case they created an unauthorized copy of the work on their own server for the purposes of redistribution; therefore they had full control over the HTTP headers.
Encode and eval the alert code so it's at least harder than searching the source for "alert"? It's not good, but it might be enough to annoy them into not doing it. Probably not.