Requests for images are no different than requests for any other URL. POST requests can also be forged, though not as secretly.