Actually, it's not - the "one-time use only" links are emailed to the customer, but the links in the My Files area are static. The key that is generated for the link (which becomes part of the link) is stored in the uc_file_users table. That's the main part of authentication, along with the uid-fid association.

So, the problem is that it seems to be failing the authentication, while at the same time passing it. It's almost like it's clicking two different links. I'm trying to think of what would cause that... Have you themed or overwritten the function for the user downloads area? are you using the link with a download manager of any type?