The event of calendar creation is viewable at Activity even by users who are restricted. Hence, users have to be careful not to describe sensitive information on the name of calendars.

This is how I reproduced:

1. Install Confluence 5.6.6
2. Install Team Calendar 5.1.21 addon
3. Create two confluence-users - user1 and user2
4. Login as user1 and:
   1. create a calendar - "User1's Calendar"
   2. Give viewing restrict only to user1
5. Login as user2 and:
   1. Go to People Directory and choose user1
   2. user2 can see the activity that "User1's Calendar" was created though user2 cannot view the calendar (See also the attached ActivityStream.jpg)