This seems like a weird case that probably doesn't come up much, but it does seem to indicate something odd is happening.
If you are logged and click on a link for a Drupal webform with contact and hash tokens that are for another contact (for instance to test that link), then any activities you do in CiviCRM will be attached to that contact. So, if you create a group, it will say that other contact created the group or if you merge two contacts, it will say that other contact merged the contacts, etc. This is fixed by logging out and back in again (and of course could be avoided by testing the link in an incognito window). Note that this does not require you to submit the webform, merely to load the webform page with the tokenized link.
I'm guessing this isn't something that is worth trying to track down, but thought I should put it here just in case.