Hello mallerd,
So, the problem is in the Symantec Web Gateway, or on the Symantec Management agent?
From what you provided it looks perfectly fine that the installer account is reported from taking the action (albeit I'm unsure how that would be present on you web-gateway) or am I missing something?
Like, the install user data is somehow present when the real user is using the software (and accessing web-sites)?