A major publisher included an image URL in the body of the message which linked to an FTP server - the path included the FTP server's IP address, username and password, meaning that all resources on the server (accessible with this username) could have been accessed by anyone.

Example format: src="ftp://username:password@FTPserverIPaddress/path/image.gif"

Possibly they had dragged some content (HTML) from somewhere else, or used an inline editor and selected the image from their internal resources.