I agree:  it might be the currently logged-in user.  But it might also be the impersonation token.  Or it could be the kerberos token acquired manually, which differ from the logged-in user.  (On Unix, it's simpler because it will always be the kerberos token, if there is one.)