On Windows 2008 it is not the aspnet user who needs permission. You need to look at the identity on the application pool used by the site and give that user permissions on both /Data and /App_Data
What happens is that by default NeatUpload will try to use the App_Data folder for temporary file and then after upload completes it moves the file to the upload destination. If App_Data is not writable then it uses the Windows/temp folder and this is what causes the file permissions to go wrong because that is a protected folder and the file inherits some permissions based on that folder which then makes it fail to be able to use the file.
Hope it helps,
Joe