Hash collision is one option, but I'd guess that would be a backend thing, and MS is telling people to update their apps...
Hash collision or not, it is somewhat worrying. It means there is room for error in the way Outlook serves data belonging to a certain account. This time it's just an avatar, but it makes you wonder if the same might happen to an actual mail for example. That would potentially be, erm, even more interesting.
Biting the hand that feeds IT
