Why can anonymous users access private files using the system URL? I have a private organic group with a private organic groups post. I have properly setup my private files system. If an image is uploaded to the private folder an anonymous user can still access it with the following URL:

/system/files/private/assets/image.jpg


However they are given a Forbidden: You don't have permission to access this on this server when access the URL this way:

/sites/default/files/private/assets/image.jpg


My guess is that Drupal is not doing it's job in the first instance; as I haven't set up private file system properly and Apache is doing it's job in the second URL due to the htaccess file in there.

Any pointers?
/sites/default/files/private/assets/image.jpg will never work because of an .htaccess directive prohibiting direct access to that directory.

Beyond that, this strikes me as an issue with OG.  I'd try executing a module_implements('file_download') and have a look at what modules might be interacting with determining if a given file is accessible.