Yup, it's likely just as you explained, people's avatars in chat (or something other chat connection, which only goes to our own server, so it remains safe).