> The site I am downloading from updates its passwords 
every 
> few hours, so when I cancel the download, and replace the 
> old password with a new one in the text source file (in 
> the format user:pass@url), resuming the download seems to 
> think all the urls are new and starts downloading from 
the 
> beginning again, instead of from where it left off.

That's correct.

> Am I correct that the only way to pass a password is as 
> part of each URL (rather than in a global password 
setting 
> somewhere in options), and is there any way to stop it 
> from starting the download from scratch again each time 
> the password is changed?
Unfortunately no.. the rescan will detect that the password 
has changed, and the engine will recheck for remote 
updates, redownloading everything.

There isn't much to do, unfortunately, except maybe to try 
to speed up the process (for example, if the link scan is 
slow due to php or asp pages, using MIME types sould speed 
up the whole thing - or limiting big files)