the mtable entry of log_display should indicate which table is affected by the users action. In the case of messages, the table indicated is user, but it is actually message, message_contacts, or message_read.
Attached is a patch for the way it should be in /lib/db/install.xml. A better way is to probably make it an update script so it corrects old installations, but this file indicates the correct tables.
Similar to MDL-15610.
There are some other minor issues in these tables. For example, glossary add entry affects the glossary_entries table, not the glossary table, but this one and the label one are the most inaccurate.