Thanks guys. In this case, the 'whodunnit' is the updateserver, so no need for another field.
The updatetime is the date/time the sourcefile was last processed by the updateserver, and so can be updated after initial creation.
So basically it's a history table masquerading in the format of a junction table.
The original question was something half-remember from a db design class years ago - specifically where there's only the two FK's/compound PK and a datetime field. This is the first time since then that I've created a table with this specific format so not really a worry!
Daftly enough, if there had been additional attributes within the table then I wouldn't have had any doubts.