Yes, this is why proper clients disable remote content by default. This technique has been used by spammers for ages. Surprisingly, the iOS Mail app fetches remote content by default - I had to turn that off.