In addition to setting permissions, running quick repair and rebuild and checking the logs you could also check your .htaccess file and if you see lines starting with “RedirectMatch 403” you can try removing them either selectively or just all of them (this reduces the security of the installation though)
I have done a bit of testing and something is definitely wrong as you have pointed out.
I also tried it on a custom module and, in addition to the “Related to” field there is also a “Contact” field (even when the module is not related at all to Contacts.
I tried checking the code but I still haven’t figured out how it works.
If I find something out I will let you know.
On your side please keep us posted of new findings.