How it works: Picture a pipe. The pipe has a huge variety of valves and possible turns (blocked off by more valves), and information flows to and from a variety of points. The pipe is the internet, and, in some cases, your e-mail providers. Your spy is trying to get you to open a valve to a point HE controls so he can tell when you read his e-mail, so he exploits the system. When most users would send something like "here, look at picture x (picture x file)!"* Your attacker sends "here, come and get picture x so you can look at it (link to picture x)!"** To get picture x, you have to open the valves to your attacker's 'point.' When you do that, he knows that you read the e-mail, but he can also determine where you are (your IP, and from that, your physical location), your OS, and your browser. An attacker might make the entirety of his e-mail picture x, in which case he can change the e-mail even after he sends it.
So, how would you stop this? Well, not easily. If you know who your attacker is, it's an easy matter to block content from his IP or web address, but most web-based clients download pictures automatically, and you can't scan e-mails that aren't ON your computer. I like @LateralFractal's idea of rendering only plaintext, if your provider offers it. Basically, for web-based e-mail, it all comes down to "what does your e-mail provider do to stop this?" Usually, the answer is "not too much." Sorry.
Of course, your attacker could also send you something like "COMMUNITY ALERT: HAVE YOU SEEN THIS PERSON? THE POLICE ARE OFFERING A $5000 REWARD FOR HIM. SEE HIS MUG SHOTS HERE: www.badwebsite.com". Then, by clicking on the link, you open up the pipe to the spy without his having to do any work at all!
*all this results in is you seeing picture x, all of the "words" are parsed by the e-mail client and turned into something readable
**still results in you seeing picture x