OK, this is weird (and many thanks for testing!)
Running exactly the same experiment with a random (student) userId you're quite right, it works fine for me too (in his case redirecting/rewriting 284 to 731). Even running me, it now seems to work(!) and I am 99% sure I am doing the same thing now, as before.
Either way, when I use the user/pix.php/X/f1.jpg URL as the src of an img in my site (the real purpose of this question), it doesn't work in my site until I open a new browser window, put it into that, have it load and then refresh the old window -- whereupon it works.
That suggests something to do with cacheing I guess. Anyway, thank you very much for answering my question as asked! Now I just need to work out what's happening now!