However, in this case -- isn't it possible to forge the email headers, making the message appear to be from a user, and thereby helpfully changing that user's monk picture to an attachment of the sender's choice?

I haven't tried this with the email address you list in your procmail recipe, but you might want to change it in case it's the one you were intending to use.

(I suppose you could have other procmail recipes in place that try and filter out instances of messages with forged headers...but if that's the case perhaps you should include a caveat to other users)

Cheers,
Matt