That is a feature of OpenSSH. It is OpenSSH that is responsible for
setting UID/GID and supplementary GIDs before starting user session.
pam_set_item(pamh, PAM_USER, "system") sets only user name PAM is
authenticating as, but OpenSSH doesn't check whether PAM_USER was changed
during pam_authenticate() or not. Questions about OpenSSH are more
appropriate in their mailing list.
This is true that OpenSSH is responsible for setting the ids; I would,
however, note that I think it's a (low-priority) bug in the PAM
implementation of OpenSSH that it doesn't honor username mappings from
the PAM stack.