If you specify a default user picture (under admin/user/settings) that is larger than the maximum picture dimensions, the dimensions are not enforced for that image. Why can't the default user image be an upload field and work just like a user uploading their own user picture? This would also eliminate some confusion about what exactly should be specified for the path of the default user image: Should I specify a relative path? Relative to what? How do I get the default image there? Should I specify an absolute url? I think this would be +1 for usability.