You are correct about the icons, they follow this logic :
- When the user is connecting, but not yet authenticated the first icon is shown. The condition is that the username is empty.
- When the user is connected and username is set, the second icon above is used.
These are the only two icons that will be displayed in the ID column.
The best i could find is in french.
If you want to look at the source, you can do so here.
As Scott noted there is a bug in the code, where the icon is not set correctly in all situations. The code changing the icon looks like this, and is only active for a change user event (USERCONTROL_CONNOP_CHANGEUSER) :
if (pConnectionData->columnText[COLUMN_USER] == "")
pConnectionData->itemImages[COLUMN_ID] = 5;
pConnectionData->columnText[COLUMN_USER] = "(not logged in)";
pConnectionData->itemImages[COLUMN_ID] = 4;
But as there are several other events involved, the icon is not correct everywhere as noted.