Well, scan hashes -- they didn't look at images directly until it was flagged. That being said, it'd require trusts from users they aren't looking at everything directly.