After doing some additional 'digging' we found that the change was made by an admin user who changed the data 'outside' of CBSubs (directly against the db table) using some custom code within the site.
So we've learned that the 'System' user is indicated when this happens.
This is now closed and appears that CBSubs is working as it should be (although our users weren't working as they should be
