As an administrator I can 'manage' the users account including changing the e-mail address, password or just about anything that the user supplies. Yes the administrator can upload the users avatar, but the user can also upload it or change or delete it. There is no way that I am aware of to ONLY have the admin maintain it.