Have you checked the permissions for logged in users and public users? Any member of a group is automatically also members of these two groups, and will inherit permissions.

Therefore, if you are planning on setting up restrictions (such as view only or request approval for download) in further created groups, you should give even greater restrictions to logged in users and public users (e.g. view only). 

More info here:

• Groups
• The Public User Group
• Setting Folder/Access Level Permissions 
• I want certain users to see images, but other users to be restricted - how do I achieve this?