Claims user avatar files are not in database

I've not used the avatar feature, but that sounds like avatar filenames are being stored in a table other than "files", so the audit would interpret them as unknown. Audit files will need a slight mod to handle these files, so I'll add this to the todo list...

Are you using the "built in" user picture function that comes with Drupal?

If so, then it stores the pictures under the pictures directory of your file system.

Simply add pictures to the path exclusion list.

Go to Administer > Site configuration > Audit files, and add pictures to the list of excluded paths and save the change. Audit files will then exclude that directory from all future reports.

Note to self - the path to the picture files are stored in the user table which is why they get reported. Thinking out loud, by ignoring the path we could have files in there that really don't have matching entry in the user table. Maybe the audit should pull in results from the user table to be really sure? Exclusion works as a temporary fix though!