You would need to state explicitly what permissions you have set and how.
I have tried both scenerios stated above uploading to a private album and also to a category marked where unregistered users can not view images in that category.
In both tests I uploaded an image and then logged out. I see a thumbnail that is not the one I just uploaded so showmembers will not pull the one that people do not have access to see. Your install seems to do so on showmembers
so please explain your exact permissions. what cat your uploading too etc