I make it available via the thank you page and also include a link to the thank you page in a the follow up email. I wouldn’t worry too much about bogus email address. It does happen, but not enough to force all visitors to go to their email to get the download. Make it easier for your real prospects.