questions regarding using webfaction for in app purchase downloads

1. You would need to have some mechanism in your website (web app) to detect this. You would likely need to include something in the headers which you can then detect on your site to indicate that the request is legit and from a trusted source.
2. With shared hosting there it is difficult to accommodate a sudden huge load spike. Our systems won't scale automatically, so the best you can do is have several machines on your account which are then load balanced across. You can find more information on that here:

http://docs.webfaction.com/user-guide/multiple.html#using-an-additional-server-for-load-balancing

Sorry that my answers are quite general, but there is no easy answer for either of your questions unfortunately.