When setting the upload folder to a non-public storage the URL that's being generated in the BE module looks like this:

https://example.org/https://example.org/index.php?eID=dumpFile&t=f&f=73&token=xxxxxxxxxx

Excerpt from EXT:powermail/Resources/Private/Partials/Module/List.html:

<a href="{vh:misc.link(path:'{vh:misc.getFileWithPath(path:\'{settings.uploadPath}\',fileName:\'{subValue}\')}', absolute:1)}" title="{settings.uploadPath}{subValue}" target="_blank">

So a concatination of the two viewhelper vh:misc.getFileWithPath and vh:misc.link(absolute:1). The latter is prefixing the URL independent of it being relative or already absolute. Due to the non-public storage the output of vh:misc.getFileWithPath is already absolute.