All the images look like screenshots taken during video calls. Also some people did some research and found the potential identity of the spammer (based on one of the accounts used) and maybe even the woman herself (coworker of the guy).

What makes people think it’s harassment?

It'd make a lot of sense to me.

The image quality was poor, and there are AI models that permit one to create absolutely stunningly attractive people, moreso than real photos. Hell, I've written scripts myself to automatically drive Stable Diffusion to produce bulk procedural images. Anyone capable of scripting up a bot to send the message in the first place is more than capable of scripting up better generation.

For catfishing, sending multiple duplicate messages to a user, which happened in this case, seems unlikely to be a goal.

I assumed that it couldn't reasonably be a scam attempt, so was guessing at it being a deanonymization effort, but harassment would make even more sense. If you're trying to drive lots of angry people to make the victim miserable, it doesn't matter if the images are annoying

in fact, it only makes them more effective, since hopefully you get more irate users sending material to the victim.

Someone floated the idea, others liked the idea, started sharing the idea and once it made full circle, everyone was sure it's harassment.

Anyone that is monolithic in a space without broad scope comments and presence is fake or potentially dangerous. No one would be posting in Lemmy, in this context of supposed community building without having a presence here. There are several people that come to mind that could legitimately post that they are "the fediverse Squid Legend" but all of these have a major footprint on Lemmy.

There is also a sketchy tracker link attached to the images, but I don't think any of us are really able to say what exactly is happening with this. Like I finally got one of the messages a few days ago and my whitelist firewall logged the sketchy link. Someone else scanned that link in a security context which flagged it as suspicious. As far as I know, that is all that is known about what is underpinning the messages from the network side. Admins likely know more.