It's possible he's using the photo sharing site along with Twitter or something similar and doesn't realise that images attached to private message are still become public.