sshd logs the message "subsystem request for sftp" without giving any identifiable information. Even the process ID (if present) is not used in other messages. Please add at least a username to the log message.
We don't log the user in all log entries because they can be correlated by PID, which your syslogd should record.
That's just the problem: the pid in the "subsystem requested" line does not match the pid in the "Accepted ... for ..." line. This might be because of privilege separation.
The privsep child pid is logged at loglevel=verbose, but it isn't hard to add the username to the message. I'll make a diff.
Created attachment 1872 [details] /home/djm/sshd-subsys-req-log-user.diff log username on subsystem request line
patch applied - this will be in OpenSSH-5.6
Move resolved bugs to CLOSED after 5.7 release