Spark settings are stored in C:\Documents and Settings\User\Spark - spark.properties file . Some community users are somehow uploading this file to a mass of clients, but i’m not sure how exactly they prepare this file. For client control you can install Client Control plugin on the server, so you will be able to control some of the option of the Spark clients. But i dont think you can leave only avatar changing to them. You can either dsable vCard changing at all, or let them change all they personal info. Also they will still be able to change a lot of internal client settings, unless you’ll make this spark.properties file read-only to them, but im not sure if Spark would be able to work properly with that.
That’s all what i can tell. Maybe some more advanced users will give more advices about this.