Not sure if this happens by design or not, but to me it's a potential issue....
When you upload an avatar you get to crop it. Fine.
So you might think the bits you crop away will never be seen again... but it seems that the whole image file is kept (and also the 'Fred updated his avatar' stream entry shows a different crop version of the original too).
To me I'd expect the crop to produce the final image and permanently discard the rest of it. Think of, just for example, a divorced couple with one of them liking her photo but cropping out the ex-husband thinking she'd just be left with the cropped version (a reasonable expectation)... problem is the whole image seems to remain (yes the avatar display is correct, but you can see the whole image, or other parts of it, elsewhere).