I'd assume he's just a botmaster that happens to automate creepy scanning of compromised email accounts for such images, but the fact that 2 of the victims knew

I'd assume he's just a botmaster that happens to automate creepy scanning of compromised email accounts for such images, but the fact that 2 of the victims knew each other suggests that he could be doing targeted phishing on new targets that he identifies while browsing accounts. I'm not familiar with Black Lotus, but looking at their page for http://www.blacklotus.net/protect/protection-for-gear http://www.blacklotus.net/protect/protection-for-gear suggests that they basically act as a proxy for a customer's service, preventing malicious traffic from burdening the server. Because whatever goes in or out must pass through them first, they can decide not to allow certain things out if they are not comfortable with it.