And why would you let them do that if no one is supposed to see that data? Either put in place a file-size limit that forces the user to web-optimize before uploading, or have a background task run through uploads, and process them to web specs. Keep only the webified files.
If you don’t want anyone to save the full-size file, you don’t want the overhead of having it loaded for everyone who views the forum thread either.