Comment 7 for bug 138955

This is a bug in gnome-system-tools (the System->Admin->Services interface), not in pam. libpam0g uses the defined interface for starting and stopping services from package scripts, invoke-rc.d; whereas services-admin from gnome-system-tools is subverting this interface, by removing the start symlink in /etc/rc2.d instead of replacing it with a stop symlink, leaving the state of the service in that runlevel undefined.

You will find that upgrading the samba package will also cause the service to be silently restarted under these circumstances.