Just wanted to let you know that I solved the problem. It was caused by UrlScan filter not liking dots in the file name. Since CS2008 is using cfs-file.ashx/__key/CommunityServer.Components.Avatars/00.00.00.21.28/avatar.jpg type of path, the dots were causing UrlScan to "block" the request.
Solution: Change UrlScan.ini to allow dots in path.