When a SharePoint 2013 User Profile is created, a default image is placed in the User's Profile. Later a User may update that image themselves. How do you tell if the image has been updated by the User?
We found the answer is that SharePoint will return "?t=" and a timestamp value after a user uploaded image in the Picture URL. If it is the default user image, there will be no "?t=" in the Picture URL.
And there is an Internal Field called PictureTimestamp where you can verify if the ?t= value equals SharePoint's value for the timestamp to make sure that the image was not tampered with.