Short answer: lack of semantic information
In a forum, the user naturally expects stuff to come from "unauthorised" third parties (any registered user, could be anyone really), not only from the webmaster (and authorised authors).
The user fully understands that messages do not represent the webmaster opinion, and are not "authorised" in any way by the owner of the domain. For any reasonable user, there is no strong particular expectation regarding the content of messages appearing in the web-page, or for images included in such messages (there is a weak expectation that scum is removed on a timely basis, but before it is removed it can be seen by anyone).
But a web-browser does not understand what a forum is. The
https://example.com/ page is expected to be trusted to come from
example.com and to securely (as in transport security) represent
example.com web-master opinion, and any big enough insecure image (in particular
IMG without an explicit size) could be used to show a big warning that
Your account is suspended. You must go to
http://fakesite-example.com/ to confirm it. If you don't, your account may be permanently deleted.
rendered as an image.
Of course, in a forum message it would be taken as representing the post author opinion by the user, but the web-browser cannot know that.