It shouldn't matter as it's the same user that is creating and reading the files (and also root has read permission to everything) but just in case cross check the chmod permissions too. root often has a different umask from other users.
Also you could check if the keystamp is right, if it isn't someone decided to hotlink the image stored on your H@H cache. i.e. say we try with this one
CODE
/h/7f24246c234e917e21e3b3fc21003d0e8dfd4985-505311-1024-1519-jpg/keystamp=1392087900-9f4ea2700e/img047.jpg HTTP/1.1
The first part is the time: 1392087900 (I'll call it <ktime> below)
The second one is a hash: 9f4ea2700e
Calculated as: sha256sum(<ktime>-<file>-<your client key>-hotlinkthis)
so for the example above:
CODE
sha256sum("1392087900-f24246c234e917e21e3b3fc21003d0e8dfd4985-505311-1024-1519-jpg-CLIENTKEY-hotlinkthis")
(PS: I'm not 100% sure whether it's sha256sum or sha1sum)
(PSPS: Tenboro's ingenuity in preventing hotlinking is peculiar)