You're mixing two different parts here.
When you look at etherscan's token page, you see the
Transfer events emitted by the quantstamp contract. These are the events that log user to user transactions for the quantstamp token. For instance, if Alice sends 100 quantstamp to Bob, it will show up in this list.
Every contract in ethereum has an address. For quantstamp, you can see that address here. The transactions shown on the primary transaction list here are all the various transactions made to the quantstamp contract.
For instance, when Alice transfers 100 quantstamp to Bob, she will make a transaction to the Quanstamp contract address, instructing it to run the code in the transfer method, with Bob's address as the recipient, and 100 Quantstamp as the value. This transaction will show up on the above list. If it executes successfully, it will emit the Transfer event, which will show up on the first list (the token page).
The last page is the token tx page for an address, Quantstamp's contract address in this case.
A transfer event under the ERC20 spec lists the sender, recipient, and the value. Etherscan parses these events, and displays them on the sender and recipient's address pages under the token tx. They are also displayed on the token tracker pages for the token the event was emitted by.
Do note that just because an event says that address X is the sender, does not mean that X was even involved in the transaction.
transferFrom and other non-standard transfer methods can emit events with any sender and recipient they want, provided the token contract allows it.
For example, the weird token shown on the quantstamp page with emojis in the name was "transferred" using a non-standard contract, and the quantstamp contract had nothing to do with it.