XMaps doesn't have this problem
That's because XMaps doesn't store its images in the same place. In unrealtournament.ini you'll have this entry:
What that says to UT is "anything accessing the /images directory gets handled by Application", which is UTImageServer. XMaps images are in the XMaps subdirectory, so get handled by XMaps.
ImageServer looks at the file type requested and sends the appropriate HTML images/jpg (or whatever) headers then the file.
The difference that UTImageServer adds is to check the username and password before allowing the request to be processed.