Your customer has a virus on his computer that is injecting the link in email and web posts. That's the main reason why we don't show external images, like this one, initially (an agent needs to click the button). Surprisingly, I know this, because we had the same issue with one of our employee laptops. In our case, unfortunately, it was on the agent side and we sent a few emails to customers with strange links in them before we caught it and cleaned up the computer.PS — The software is open source; hosted at https://github.com/osTicket/osTicket-1.8; so you can read the source. No need to be paranoid.