The is more of an FYI blog post but I have read several blog and forum posts on this subject and I decided to dig into the behavior which revealed a trace bug.
For the vast majority of events the Session Login Name represents the originating session credentials where as the Login Name represents the current session credentials and everything works correctly. The login name could be different for instance if there was an execute as in progress.
I found was the Existing Connection event incorrectly produces the session login name of the user who is starting the trace instead of the user associated with the login information of the existing connection.
I have filed a defect to get this addressed in future releases of the SQL Server.
Bob Dorr – Principal SQL Server Escalation Engineer