He works around this by reading the email himself first, clicking the option to always display images from the sending email address and then starring it so the email is always at the top of his inbox even though it has been read.

I suppose an attacker could bypass this method by turning off images in their browser though.