So, at first I had this big answer written up about all the situations this doesn't help in. Y'know, people who didn't set an email, people who never registered with Gravatar, people who forgot their Gravatar credentials because most email-access-losing situations are 2+ months time from initial registration which is ample time to forget, etc. Basically, that this isn't a terrible idea that needs shooting down, just that it is a very specialized bullet.
(Also was going to note that the whole hash thing is excessive and unnecessary, it does nothing towards confirming ownership that us just generating an image from a random hash and telling them to use the image won't also do).
But as I wrote this up, I realized that the larger issue is that this is confirmation through an unaffiliated third-party service. Seeing as the whole point of the process is ensuring that only the right people get access to the right accounts, entrusting a portion of that process to a service and company to whom we have no control or vision into, reeks of very poor processing on our part.
Imagine I put a colorful metaphor here about entrusting private, personal data access to an unassociated outsider that didn't sound as stupid as the bank-trusting-pawnshop one I originally came up with.
It looks pretty shady, honestly, is the issue.