Aha, two days ago you told me, you've reverted to 2.3.6.1. Maybe I misinterpreted you.

No I just reverted the file regarding the other problem with 2.3.7 temp_block_ip_after_repeated_failed_logins

Yes it does. The problem in this case is the fact, that the file name of the avatar is a compound of the user-ID and the file-ending. Milos ID is 25 and he uses a GIF, so the avatars file name is 25.gif. If your user replaces the old avatar with a new image of the same file type, the file name will be identical. The browser might use it's old, cached version instead the new one.

But I can't get my head around why this problem is occurring now for me and my users since updating to 2.3.7 did you change the way this is handled then? All the previous versions (3 or 4 version updates I've been through) and never had this problem come up.

Is there a way of sidestepping the cache so avatars download fresh every refresh? As some users are seeing 3 images old avatars.