In your config.inc.php:
// Display remote resources (inline images, styles) in HTML messages
// 0 - Never, always ask
// 1 - Allow from my contacts (all writeable addressbooks + collected senders and recipients)
// 2 - Always allow
// 3 - Allow from trusted senders
$config['show_images'] = 0;