There's actually a simple technical way around this. Don't store the paper. Store a file hash and let the user access it via approved channels. Most users here will have legitimate access via their institution, or can easily find the paper via Google. Dedupe on upload and link to approved Elsevier stores. Easy peasey.