You can sign messages other than transactions (spends); maybe someone signed a message with the same public key as the address (bad explanation)