Overwriting the DeleteFile API in the target process under debugger control comes immediately to mind so that the program can create files, but can't delete them afterwards.
However, that's probably just me going completely over the top again, as usual
It'll definitely work though...