When hook_forms() gets involved, the usual rule that the string passed drupal_get_form() equals the function that loads the form equals the a form ID is not necessarily true (and i think forms can "lie" about their form ID anyway).

So the places that X-ray talks about the parameter passed to drupal_get_form() in the page callback exposer and the Form ID in xray_form_alter() should try to investigate the true function behind the form and tell people about that. (As noted above i'm not sure hook_form_alter() has a guaranteed way of knowing what called the form into existence, though, but it could do an if function_exists on the form_id and look up hook_forms if it doesn't exist, so only blatant lies wouldn't be caught...)