Attach a script trigger to the container field on the portal row which exits the field if the container is not empty.
So I came up with this script and placed onto image container as an OnObjectModify Trigger:
If [IsEmpty (Image::Image)]
Exit Script 
Show Custom Dialog ["Insert Image"; "Are you sure you would like to replace the existing image?"]
If [Get (LastMessageChoice) = 1]
Commit Records/Requests 
Revert Record/Request 
Only minor flaw is that it still asks you even if an image is placed into an empty container.
it still asks you even if an image is placed into an empty container.
Well, the container is no longer empty at this point, is it? Try using the script parameter to determine the field's content..
Or - preferably, IMHO - deny users privilege to edit records, leaving them with the option to create new records only.
going to look into modifying the privilege sets.