This could still be related to the bitcointalk hack back in 2015. Some of the accounts could be dormant accounts that weren't on in awhile so they couldn't change their password.
I see, I don't think I have changed my password for a couple of years, so what you say makes sense.
Perhaps the other users whose avatars were changed might also have old passwords?
In which case a hacker is on the forums today using the passwords gathered from the 2015 hack you mentioned.