Interesting for me as well. When I make a change to the hosts file in \drivers\etc\ across the network via UNC pathways from my workstation using an app like notepad, LEM shows NTAuthority\System. When I log onto the server using rdp and perform exactly the same thing, I get 3 entries, 1 for NTAuthority\System and the other two with my domain\username details.
Not that this makes the product useless, but it means that the larger portion of accesses recorded by FIM are. I suppose I should call and log an issue as well to add to the numbers.
edit: I upgraded from 5.7 as opposed to a clean install.