Actually, the permissions of the dirtags should only allow the owner of the directory (and of course masters and vfs masters) to download this directory. Are any other users able to do so ? If yes, please show me at least one raw directory listing where the dirtag is world-downlodable.
I'm also wondering if some ftp clients aren't ignoring the read permission and are simply using the directory name to MKD on the other side. What ftp client(s) have you used for your tests ?
Last but not least (and not directly related to this particular problem), why do you add users you don't trust ?
Not using a skiplist is a shame nowadays.