I think short of them giving them access to your media library the only way is to use third party hosting sites.
If they need to keep the images private on the external sites there are sites that will allow that.
Does anyone know who is taking responsibility?
All the indicators seem to suggest it is an S2 issue.
What is their comment on the matter?