Making an API call containing rcnamespace=* to get all namespaces does not include negative namespaces, like -1 for Special pages. For the most part, log actions do not take place in any negative namespace, however, logtype=abusefilter actually does. This is probably why it's taken so long for anyone to discover this.

To reproduce this, simply make an edit to an AbuseFilter, and then make two api calls. First something like /w/api.php?action=query&format=jsonfm&list=recentchanges&rcprop=title%7Cuser%7Cparsedcomment%7Cloginfo&rcshow=!bot&rclimit=20&rctype=log and then something like /w/api.php?action=query&format=jsonfm&list=recentchanges&rcnamespace=*&rcprop=title%7Cuser%7Cparsedcomment%7Cloginfo&rcshow=!bot&rclimit=20&rctype=log

The first result should contain the AbuseFilter edit, and in the second one it is mysteriously elided.