In nginx-rtmp-module 1.0.6 current stream timestamp is returned in stat xml for each client entry. The value is the last timestamp of rtmp audio/video packet sent to that client. These are usually the same for live stream subscribers except for dead clients (the new feature makes it possible to find such clients). However with VOD streams the feature makes even more sense showing stream position for each client.
The timestamp value is sent with on_update notification as well. Now you can use this value on server side for stream status update & validation. You can limit playback duration for certain users returning HTTP 5xx error from on_update when timestamp exceeds predefined limit. Don't mess the new timestamp argument with the old time argument which is client connection time.