Problem solved.
The plugin “User Access Manager” was found guilty of inserting a .htaccess file into wp-content/uploads/ and not handling calls properly afterwards.
I don’t know how UAM plugin could be fixed, but It’s ok to remove the .htaccess file. Nothing else depends on it. (at least in my case)