They need to provide avatar, given hash, i.e. implement a public getavatar(emailhash) function. They don't need to provide hash given account, i.e. getemailhas

They need to provide avatar, given hash, i.e. implement a public getavatar(emailhash) function. They don't need to provide hash given account, i.e. getemailhash(comment). If someone uses a unique avatar they can be identified by bruteforcing emails, generating md5s, then querying gravatar, but I assume most users don't change from the default. You also couldn't prove it, because you may have missed a different email which has the same avatar.