I can't answer to the law, which besides will vary - and I reject the implication that a puerile prank is immoral. But that aside, taking it on as if there was any moral dimension, moral clarity is straightforward here:

The parasite has to answer for the material it shows its visitors.

If a butcher delivers outdated meat to nowhere, knowing his van will be hijacked, how can he possibly be blamed when the hijackers sell it to their customers?

Edited to correct can (van!)

I am not sure that actually, the intermediate site is even technically sending the image.

As I understand it, the iframe is set up such that the users browser loads your site inside the frame and the intermediate site outside of the frame. If you serve a file then you are serving it directly to the browser. The intermediate site never sees it?

Better example is if someone is automatically forwarding your email newsletter and claiming it as their own.

If you email them explicit imagery and they automatically forward it, that's on them.

Not a crime, but a little crass in a funny way.