I think we'd have to see the .htaccess rules.
It's likely because it's disallowing incorrectly, that is, let's take one scenario:
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER}
!^https*://(www\.)?example\.com [NC] RewriteRule \.(gif|jpe?g|png|swf|flv)$ /alternate_image.jpg [NC,L]
Note the bolded line.
The * in https means "zero or more 's' characters" so this rule will be ignored for http AND https if the other conditions match.
(www\.)? this means "one or zero of the preceding" and is intended to capture the www version and non www version.
Overall, if the referrer is from example.com or www.example.com, secure or not, and the request is for an image or .flv, this rule will not match, but all other referrers will be served alternate_image.jpg.
You're probably experiencing something like this. You also have to be careful not to disallow Google images or other external resources you might want to allow.
More info from this site [google.com] (G search in WW)