Sorry for not knowing the exact versions.
I've noticed this on confxhtml notifications but assume it happens in 3.5 too as a result of the new "email pretends to come from a user even though it's actually from the system" feature.

When the from address uses the "username (Confluence)" style and somebody moves a page, the mail comes from Anonymous (Confluence). The rest of the mail uses the correct user. I believe there used to be a similar bug from the "Moved By User" text.