That’s pretty standard with moz - junk mail use hotlinked images and shit so they can see on their traffic side when an email is viewed. It’s why mail programs increasingly block external content by default (well that and the viral payloads). When you flag as spam, thunderbird takes it out of the ‘allow remote content’ list.