1. yes it is, but that isn't the point, if the avatar is in an off-site location then it is possible that is what is being alerted on.
3. well it can determine the location as ultimately it has to be fetched from a location, that IP would also be monitored and checked against the malicious sites list.