I created an account, realized I was logged in to someone elses gmail, then changed the email to some other random gmail adress, and I seem to have automatically got this new random persons profile picture in my math.se account. I am just curious of the mechanism of this, did SE extract this random persons picture by an intended feature of gmail (ie this user has acknowledged extraction of his picture given only his email address), or is it a bug?
The other person probably has an account on Gravatar, which this site, Wordpress.com, and other websites check for an avatar whenever you enter an email address. If someone knows your email, then they can see your Gravatar. Nothing secret about it.