Looks like it's hard coded into all the yaml files in /include/i18n/en_US/templates/email.
<em style="font-size: small">Your friendly Customer Support System</em>
<br>
<a href="http://osticket.com/"><img width="126" height="19"
style="width: 126px; " alt="Powered By osTicket"
src="cid:b56944cb4722cc5cda9d1e23a3ea7fbc"/></a>
Wherein that src points to an id defined in include/i18n/en_US/file.yaml where the image is base64 data not a normal png file.