Comment by escalt

Well, clearly they sent it to you, so they're distributing the images. The E-Mail headers, especially if they contain a dkim signature, are likely sufficient proof for that. If not, the provider they used might be able to back your claims up. If you were using some E-Mail provider instead, those images would still land on your client devices, and the situation would be almost the same. And of course let a lawyer do the talking