Again, if it's spoofed URL the image should actually leave the sever because the original IP would not acknowledge the connection. Are you sure the pics left your domain?