Turning on debug output would probably offer a clue. That's done in site.ini.append.php in the siteaccess of your public site. One possibility is that the images are being stored in the media section, and the roles are set such that the anonymous user does not have read access in the media section.
