I found something about my DP early on (googling, I was a bit paranoid!). It wasn't a dating site, just a social media thing, and it was basic info and a pic he'd used as open profile pic on FB.
As I say, I was a bit paranoid due to past experiences and trust issues, so I dug a bit deeper. Turned out, I also had a profile on the same site!! I know I never set it up, so must be a hacker or computer generated thing from robots sweeping the web.
Now I know this doesn't cover the cock pic, but if he sent it to you on FB it might also have gone to your email address if you didn't read it straight away?
My email has been infiltrated before and started sending all sorts of weird stuff around.
It might be tenuous, but just trying to say don't end your relationship over this unless you are sure it's a cover up for something worse.
Maybe Google yourself to see if the same has happened to you?
The fact that he hasn't opened the messages is reassuring!