[cd34]

Any .htaccess rules that might deny from *.domain.com or deny from 1.2.3.* that might cover him?

Any RewriteCond rules that end in [F] for something he might match? perhaps an overly aggressive anti-hotlinking rule? Perhaps a rule blocking robot-browsers?

Many things can cause a 403 -- if the page is able to be loaded by some people but not others, I would suspect that it wouldn't be file permissions but some selective access. Its also possible, but a little less likely that something in the submit script is generating a 403.