Apparently there’s a vulnerability with sending messages with images in them and “she” might be logging people’s IP addresses through that.

If the images are hosted on your instance, this wouldn’t be relevant. If they’re links to an image hosted somewhere, this is possible, but there’d be a lot of noise and not much value. To link accounts to IPs the URLs would themselves need to be different

I checked the urls to the images in my PMs and they’re all hosted on Lemmy.