encode the viewer's IP into the image (with steganography, wrote a small script for that) on the server (every request). whenever your image pops up somewhere in the web you know which IP address is to "blame" (easily bypassed with IP obfusication software though :) )