Modlog, which includes a site ban—something only admins can do.
The community bans also include communities that aren’t moderated by any instance admins, and some that are only moderated by a single person who likely isn’t aware of actions taken under their community’s name.
FYI, any site bans will also automatically generate community bans for all local communities that user has ever interacted with.
It’s simply the current behavior for site bans and not an admin going through communities to ban that user.
That doesn’t mean the site ban is legitimate, just that the community-bans are inherent to any site-bans.
That’s kind of a weird way of doing it, but good to know thanks!