Gravatar should stop their support for unsalted MD5 hashes. It's just too insecure when most people don't understand the implications of sharing a MD5 hash of a user's email.
Similarly having it be a salted (instead of the currently unsalted) hash wouldn't help anything. The salt would need to be public for separate web sites to reference the same avatar for the same email address.
Short of authenticated requests to Gravatar (which again kills the point of how it all works), one alternative would be to make the computation function more expensive, either by performing multiple rounds of the hash function or switching to a "slow" hash function (ex: bcrypt or scrypt). The latter would require a fixed salt and wouldn't really work for the use case as it'd slow down any webpage that links to multiple gravatars to a crawl.
The real issue here is that the email address space is fairly predictable. If you want HASH($EMAIL) to be unpredictable then instead of first.last@example.com switch to ~ [a-z0-9]{16}\@example\.com.
They don't need to provide hash given account, i.e. getemailhash(comment).
If someone uses a unique avatar they can be identified by bruteforcing emails, generating md5s, then querying gravatar, but I assume most users don't change from the default. You also couldn't prove it, because you may have missed a different email which has the same avatar.