..the first entry returns a 304 status as expected..
both requests should have been served a 403
Forbidden, not a 304 Not Modified or 200 OK. So your code doesn't work at all, or have you seen 403s in your logs?
I'm not seeing any errors in your code though, except for the "L" flag, which is not needed when you use [F]. You could try your code with only the [F] flag but I don't think it will make a difference.
Are there other rewrites in your htaccess? Ones that work? Does your host support mod rewrite?