Thats true, the vbulletin software does not login to the server with the owners username and password. Actualy, it doesn't login at all.

Part of the confusion might be the use of the word "user". I've been talking about users in the OS, which is different than vb users. If you set a directory to be writable to everyone (all OS users, that is), that probably isn't an issue.

Edit: I guess what I'm saying is that I agree, you should set it to 777 and see if that works.

i looked at mine, and it is also 755.
Also there is 1 directory in it, called thumbs, and there are 2 files called: index.html and thumbs.db

Which would be 'safer' - more 'conservative'? 0777 allows for execution, and 0666 does not, yes?

correct.

The "execute" bit means something different for files than directories. While it means "executable" for a file, for a directory is means "searchable". It may or may not work with the directory "searchable" bit set to off, I don't know. But you probably won't be able to do a directory listing in ssh.

As to this question:

But this crossed my mind...
Do you save your images in your database or on the filesystem?
That could explain something.

I don't know, but given there are no images in the directory, yet the Administrators avatars and profile pictures are being seen, I'd say in the database. How can I validate that?

I'm off to work haha, KH99 will take over ;)