You should register event handlers during Application_Start, so they are only added once.
Registering your event handler during End_Request means that every request will cause another duplicate handler to be added.
AuthorizeImage isn't being fired 50 times; 50 copies of your handler are being registered with it.