When Moodle's security settings are set to "Force users to log in" (forcelogin) under Security > Site Policies, user images are prevented from showing inline in popular mail programs such as Outlook and Gmail. Instead, the default user silhouette image displays.
It would seem reasonable that an admin would want to enable forcelogin without categorically preventing user images from properly appearing in embedded HTML e-mail messages from forum posts. Actually, this other setting under Site Policies: "Force users to log in to view pictures" (forceloginforprofileimage) seems like it should be the setting that should govern this behavior, and its corresponding help text indicates as much: "If enabled, users must login in order to view user profile pictures and the default user picture will be used in all notification emails.". However, I have found that as soon as forcelogin is enabled, the user image will not appear in the e-mail message, regardless of how forceloginforprofileimage is set.
I would recommend that if forcelogin is enabled and forceloginforprofileimage is disabled, the user image reference encoded in the HTML e-mail should display the user's proper image rather than the default silhouette image.