Most automatic crawlers don't have time to comply with the registration procedures of all Web sites. If the picture names are not "guessable" then they won't be harvested by crawlers which scan "the whole Web". However, of course, any registered user who can see the pictures will be able to slurp all of them (and not only images, all the Web pages as well). The well-known opensource tool GNU Wget has command-line flags for recursive exploration of Web pages.
Note that the server can know, by construction, who is making each request (that's what it means that a user is "logged in"). You can then implement restrictive rules such as "no more than 10 pictures per user and per minute" or similar constraints. With such rules, a user bent on downloading all your files will have to create many fake accounts, register them all, and use them more or less in parallel. You can also filter on source IP address (if too many requests come from a single IP address in a short time, ban that address temporarily).
All these deterrents are just that: ways to make the task slower and harder for attackers (if we call people who want the pictures "attackers", which is subjective). Motivated attackers will obtain them nonetheless.
Generally speaking, when you publish a piece of data, then it becomes "public" and you cannot really control where it goes. This is the dilemma of all media content providers: once the music file is out, it is out.