Can't you .. in a course, 'pretend to restore' ... choose the file resource ... which might need to be private files. Once the backup .mbz files are displayed, right click on the one want to download ...
Or click the button for managing files in the download resources available.
Once downloaded, cancel the restore.
Then double 'EEhhhhh' ...
When viewing an interface that shows .mbz files, cannot you right click on them or click the link that says 'manage files' and download an .mbz?
How are adding .mbz files to 'draft'? Are we talking any files or just .mbz's (backups)?
Have you in the past, downloaded an .mbz, then created a link to a file resource in your course which required you to re-upload the .mbz. Now that a .mbz backup is too big, issues ... uploading.
Students have been made teacher in your course or student role for site has been granted permissions to view them.
Check permissions on student role - every where ... course level as well as site wide and maybe overrides you did for students.
Check a known student account (or one that you think is student)