Avatar filenames are constructed with:

1. constant salt
2. user/group id
3. image extension

phpBB assumes that, when a user submits a new avatar, the old one will be overwritten. This is not true when the old and new avatars have different extensions, e.g. GIF and PNG. It results that orphaned avatars may remain on the server.

A check should be performed, whether the extensions are the same, and if not, delete the old avatar.