This my biggest reason to hesitate recommending nostr. This shouldn't be something people stumble upon. Block/report the user, report to the image provider, remove the relay. Nostr itself doesn't hold the images, just holds the text links. Some services like nostr.build and likely other relays will pre scan and also file reports.