Jabber client mysteriously importing photos

Question

Thanks for the forums, they've been a helpful resource setting up Jabber.
We deployed the Jabber for Windows client 9.1.2.12936 recently, and have gotten reports that photos are showing up for contacts that people never published in AD or Jabber.  One user reported that a picture was added next to two people's names in her Jabber list, despite that they were not in her contacts nor are they friends on any social media sites.  The photos that showed up are potentially from Facebook and were saved as:
[email protected]_jabber_thumb.png
[email protected]_jabber_profile.png
[email protected]_jabber_phone.png
The Jabber log file on their PC shows a lot of entries similar to this one:
013-03-07 14:55:37,484 DEBUG [0x00001844] [rs/directory/ContactAvatarCache.cpp(125)] [contactAvatarCacheLogger] [GetImage] - Local URI: C:\Users\xxxx\AppData\Local\Cisco\Unified Communications\Jabber\CSF\Photos\xxxx@domain_jabber_thumb.png
But no indiciation where the photo originally came from.
We use UDS for a Directory Server.  Can anyone suggest how we track down why this is happening?  Users are understandably alarmed.  Thank you.

Answer 1

The photos do not appear to be in the local Outlook contacts nor do I see any outbound connections to Facebook when I reproduce the problem. 
Anytime I delete the photos they come back pretty quickly.  I've done packet captures and used Process Monitor to troubleshoot, and think ContactSearchPlugin.dll is responsible for this behavior but can't see exactly why yet because the connection to the Jabber server is encrypted.  No external requests are made but perhaps they were in the past and are cached somewhere other than the Jabber photos directory.
Only one user has reported this problem so far and her machine scans clean for malware and viruses.
PersonManagerForensics.txt has a lot of info but no smoking gun.  Is there any additional debugging I can turn on specific to contact retrieval?