Lemmy seems to just take the first item there and then abort if it's an image not a link.
That is correct. But so reordering would result in losing the image. I linked to the issue at Lemmys GH and it was marked as resolved just recently, so they should be able to consume multiple attachments soon.
I don't understand why Mbin is using source instead of url.
This I also don't know, but as we also put it in the attachments, it should be fine.