The TWiki::Func::writeLog has docs stating that the WikiName can be used for user. This is actually not supported, it must be cUID or login name.
This fixes the issue by relaxing the spec: For user, either the WikiName, the cUID or the login name can be specified.
Why/how bug was discovered: The WatchlistPlugin
logs showed "unknown" user for immediate notification in a site that uses LDAP authentication.
This is now fixed in SVN trunk and 5.1 branch.