Refer header is not a good way to distinguish between embedded images and images accessed directly by user. AFAIK that header will have the same value both when you load an embedded image and when you click on a direct link to the image.

I did a little bit of research about it few years ago; the summary can be seen here:

http://temporal.pr0.pl/devblog/2009/09/14/eksperyment-podsum... (pl_PL)

http://translate.google.com/translate?sl=pl&tl=en&js... (en_US)

Basically, I was able to distinguish between embedded and directly accessed images by analyzing the content of Accept header. It wasn't perfect (it didn't work for Opera), but I think it could be good enough to do something useful with it.