The license file is loaded from the root folder application.
Putting it in the root-folder (same folder as web.config) makes it possible for anyone to download it.
You need to configure your server to prevent that.
You can use .htaccess file for that e.g.:
AuthName Secured
AuthType Basic
AuthUserFile .htpasswd
<Files MailLicense.xml>
Require user admin
</Files>
or web.config (IIS 7.0):
<system.webServer>
<handlers>
<add name="BlockLicense"
verb="*"
path="MailLicense.xml"
type="System.Web.HttpForbiddenHandler" />
</handlers>
</system.webServer>