Indeed, I saw this as well and much cursing ensued.
Discourse is not designed to obscure the underlying uploads bucket name and in the intervening days have been hoping nobody used one of ours.
The worst thing is that even if you observe the attack, there is nothing you can do to stop it.