Perhaps TL0 should be changed from:
cannot post images
to:
cannot upload images or attachments - preventing avatar changes until they have become familiar with the forum (TL1).
https://meta.discourse.org/t/what-do-user-trust-levels-do/4924/3
It’s a bit worrying that they can effectively just host images on the system via the background / user profile…
… with no obvious visibility of these (posts are easy to spot and check).