All uploaded attachments, which are available to all (without logging-in), should be available directly through web-server without execution of PHP-code. The files' original names should be preserved even if some identifying information is inserted in to the name (lolcat.jpg becoming lolcat-AID.jpg, for example).

This will make serving the files much faster, facilitate use of proxies (CDNs), and reduce the load on the server's CPU and database (almost) without compromizing functionality.