Based on https://www.sendpluto.com/help, it looks like they could be creating images of the email text and sending the images in an email. That way, they're free to manipulate the image even after the email is sent.
This would only for images linked back to Pluto correct? If they simply sent an image surely they can't come into my inbox and modify files?
Correct. The scheme requires some way to link the received e-mail's content to Pluto's servers. This must be so because it's not possible to delete or modify an independent email (i.e. one without links) once it's been delivered.