In my early CentOS builds, the files were owned by the web server (possible usernames would be apache, httpd, or nginx). Later on, the proper ownership changed to the user account for the respective site (possible username may be the ftp/sftp username).
To test, upload a test php file into your /data directory and then attempt to run it from your browser. If it works, then go to the command line and see what it's owner:group combination is. Type this within the data directory:
ls -al
Note whatever is shown for your uploaded test php file for permission and ownership.
Then create a test user in your xenforo installation. Login to it from a browser you don't normally use and upload an avatar for it, make sure you can view it normally from your site as any user would.
Then go back to the command line and find where the avatar file is. Does it's permissions and ownership match your test php file? If yes, then try going back to your browser and see if you can replace the avatar on your test user. If it works, then you know what the proper ownership and permissions should be on all of your avatars.