Ah, my bad — I hadn’t used Gravatar before and assumed it needed a verified or logged-in email.
Didn’t know it just checks if the address is registered on Gravatar.
I didn’t expect that one of my users’ randomly entered emails happened to have a Gravatar avatar!
Thanks for pointing that out!