Forgive me for not reading all the comments to discover if someone has already said this, but I found an image-hosting bug:

It'll get the same security level as you've set as the default security level for your whole journal, so if your journal has a minimum security of private, your images will be private; if your minimum security is public, your images will be public; etc.

My default journal security is access list, and my default email post security is private. However, both of my test pics uploaded as public. Either that, or the first one uploaded in an unknown security state and changed to public when I changed the post to public, but either way, the second pic uploaded as Public.

Edit: Submitted a support request.

Edit2: Also, thankyouthankyouthankyou! Did I mention how excited I am about this new capability? :) *still bouncing in chair*