The same thing happens to me, any user can edit their post and delete the images from the gallery uploaded by other users to other posts, previous versions solve that by adding -1, -2 … to the end of the image url.
This way you can delete the entire WordPress upload folder.
