Comment by romland

You say "All test files are deleted after 24 hours.", that implies to me that files people upload _could_ be downloaded too.

If that is the case, that is where you are vulnerable. Free hosting of a file at a trusted domain is worth something.

If people are not intended to be able to download their test files, check your logs, someone might have found a way around it.

That's the best I can think of.