Hello,
if they try to upload more than one they get a warning saying they are not authorized.
Uploading multiple attachment files per private file post is made possible by using the Enhanced Files add-on. This add-on also adds a few extra features, like some extra icons packs, or the possibility to choose which file extension should be attempted to be opened in the browser itself.
The files uploaded by customers can only be seen by me (customers must not see other people’s files).
Then, it is recommended in your case that you set up, for each private content, a default owner (you), and disable, in the capabilities setting screen, the ability for your subscribers to select an owner.
Regards.