This is true. This happened to me when I had the browse @2bob tariff activated then I switched it off to use WiFi. I think I used WiFi from like 10pm and left my phone hooked up to the same WiFi after chatting online @2am.
In the morning woke up @6am and continued using WiFi. @9am something told me to check my data balance and 10bob was missing. I immediately informed Safaricom on Twitter and they told me that my data was active at MID NIGHT. Like WTF I was still awake at midnight using WiFi and you telling me my data was active?
They told me to check my Selfcare account and for real at midnight I was billed for data that I did not use and I told them there is a problem somewhere. I was so awake at midnight chatting with a friend using WiFi. They told me to prove it that I was awake. I gave them my Orange data billing that shows I was so active from that 10pm to 5am. Problem is, the WiFi was hooked to a different device so they still argued that my phone had data active.
That gave me the valuable insight that Safaricom has a script that runs data on people's phones. This post just proved it.
Did you try and tell them about it? What I currently do nowadays is activate data manager after I'm done with downloading my stuff to prevent that from happening.