The User-Agent header is entirely optional in the HTTP protocol, and its absence is in no way indicative of a malformed or malicious request. Is there some reason you're blocking requests that omit it?
The Internet Engineering Task Force (IETF) tries very hard to be careful in its wordings, and differs between terms such as "may", "should" and "must", for example. I had a (very) small part in the inclusion of User-Agent in the 1992 draft of HTTP/2 (my bold emphasis):
This line if present gives the software program used by the original client. This is for statistical purposes and the tracing of protocol violations. It should be included. The first white space delimited word must be the software product name, with an optional slash and version designator. Other products which form part of the user agent may be put as separate words.
https://www.w3.org/Protocols/HTTP/HTRQ_Headers.html#user-agentIn 2013, the HTTP/1.1 specification was revised to include User-Agent (IETFs capital emphasis):
A user agent SHOULD send a User-Agent field in each request unless specifically configured not to do so.
https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-p2-semantics-23#section-5.5.3Granted, since then, the User-Agent string has been used and abused in every possible way, and has become overly long, lying about what it really is and used for branding and advertising.
My suggestion to let the forum proxy include User-Agent is purely pragmatic, in that it may help alleviating some users' issues, given that some image servers block requests without it.
