Ok so I found another one, although they’re slightly less frequent now.
The images are indeed marked as secure in the database (and were not hotlinked), with the reason access control post dictates security | source: post creator, despite the access control post being a public post that was never edited nor moved.
Like the previous post above, the first image in the post was not marked as secure but all of the others were.
A very similar thing is occurring on a different forum although in this case only the first upload is secure but none of the others.