User photos in user.module should be managed files. This would let the D7 version of imagecache know that a user's profile picture has changed and flush the old thumbnail. I've done a little work on this and it's been a good exercise because it illustrates some problems with the reference counting blocking deletions and the question of overwriting managed files in.
Unable to apply patch user_357403_10.patch
Unable to apply patch user_357403_9.patch