the mtable entry of log_display should indicate which table is affected by the users action. In the case of messages, the table indicated is user, but it is actually message, message_contacts, or message_read.
Attached is a patch for the way it should be in /lib/db/install.xml. A better way is to probably make it an update script so it corrects old installations, but this file indicates the correct tables.
There are some other minor issues in these tables. For example, glossary add entry affects the glossary_entries table, not the glossary table, but this one and the label one are the most inaccurate.