If you are running Drupal, and allow file uploads, make sure that you have the file uploads being handled by Drupal.

You want:
"Download method:
Private - files are transferred by Drupal."

Otherwise you have a massive gaping security hole in your site.

Aaron