attachAccount.php can merge local accounts into a global account with the same name, which is a sensitive operation (it gives the global account owner access to the local account, and under some conditions the reverse as well). It's logged to Logstash, but there should probably be a proper on-wiki log entry as well.