Actually, I take back what I said in the previous comment. Based on the HTTP spec, I think this Forbidden is the most appropriate code. 

From http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html:

10.4.4 403 Forbidden
The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated.