Add a system where a warning appears when another person obtains the exact IDs of your avatar when an avatar is set to “private” before uploaded to VRChat. When there is a case where another person is using your avatar ID, the warning brings up a message that shows the name and current picture of the person using your avatar along with buttons which allows you to “report” the person who is using your avatar ID or you can “give permission” for a person to use your avatar ID.
In theory this should work if IDs are not the same as other avatars uploaded to VRChat.