Mahz hands them out as he sees fit (in between bouts of coding), mostly in the Spam section. Nothing can guarantee you an avatar.