Hey Sam.
Looks like there was a bug with the avatar permissions. I think it was related to adding group permisions to them rather than having them controlled only by trust level.
I upgraded your site and it’s resolved.
Sorry I didn’t make sense of this sooner, but the stuff about the S3 sent me off in a totally wrong direction, so it didn’t occurr to me that it was as simple as “regular users can’t change avatars” which turned into “…because there is a bug”.
I imagine that the bug was in the code for only a day or two, so it was just unlucky on your part that you got bitten and probably very few had the problem (since you’d needed to have upgraded your site in a period of hours that the bug existed), so it wasn’t widely reported.