Guest can download attachments although it is set differently

[~sullengirl~]

I have noticed today that guests can download any attachment from my site (example), although it is clearly set differently in ACP (this is a setting for subforum example link is from):

Did I miss something, is there a tool I should have ran or something?

This is not good. Not good.

[Unlucky]

have you found a solution to this yet?