If they have a file in their profile. I can do the same thing. Everytime someone clicks on my profile they hit my image pic. I can look at my raw logs and see who clicked that image file and from where. That's not hacking. They still cannot match it up to a specific user name unless a user comments about it right after hitting it.
I don't know about hacking pm's. Maybe he is bluffing. He'd still need a password cracker from a spoofed IP or something so he doesn't get caught by SI. I personally don't think it'd be worth the effort.