Yes, the picture actually left the domain, we checked the bandwidth usage (and number of request made to the image) and it all matched up, so yes, the image did in fact leave our domain.

Another note, the majority of these machines were in Asia. Mainly company webservers believe it or not. They also all seem to have port 4444 filtered (maybe a trojan? which would mean someone went on IRC somewhere to tell it what to do)....

but anyway, we are just going to use the URLScan option to fix the issue and let the guy get tired of playing around (yes it's still doing it after a few days).