Any reasonable embedding of a graph should be as an attachment that your client receives at the same time as the rest of the email. > There's no way that was a

Any reasonable embedding of a graph should be as an attachment that your client receives at the same time as the rest of the email. > There's no way that was an intended part of the design. There is certainly a way. And regardless of whether it's intended, it you're dead-set on configuring your system so that it automatically contacts arbitrary 3rd party servers, then you shouldn't be too surprised when that happens. "Bad guys" are known to be opportunistic.