I agree. And that's what I set out to do. I ended up at:
x-cart-directory/image.php
I tried commenting out the following line of code from the file where ever it was called (a bit rough I know) as all of the thumbnails for the products are held in the database. But it had no effect... not sure why... it's something that I'm planning on chasing up and testing further when I find time.
Code:
header("Content-type: image/gif");
func_readfile($default_image, true);