PostgreSQL 9.4.6 under RHEL 7 - Extensive logfile because of log_statement_stats - Can't turn off
There are multiple levels where you configuration options are set in PostgreSQL:


system defaults
values specified in postgresql.conf or the startup command line
values preset for a database, user (maybe others, too) using, for example, ALTER DATABASE ... SET {option} ...
values set for the current session


Going down the list from 2., you have fewer and fewer options to set.  Furthermore, there are some that can only be set by a superuser (log_statement_stats) being one of them.

At the same time, the lower in the list an option is set, the higher its precedence: a session-level setting will override all the upper levels.

Speaking specifically about log_statement_stats, it is possible to set it from a session - but only a superuser can do it.  If your application connects with a superuser role (which is not really recommended), it can set this as one of the first things after obtaining the connection.  Look for it in your sources.

Ways of changing settings

The numbers refer to the levels listed above.


Supplying defaults at compile time
ALTER SYSTEM - this will store the settings in a postgresql.auto.conf file, which will be read in addition to postgresql.conf.
ALTER DATABASE ... SET ... or ALTER ROLE ... [IN DATABASE database_name] SET ....  Some settings can be set on database objects (like tables, functions, etc.), too.
SET \[SESSION\] ... - to change things for the current connection (often dubbed 'session').  There is even a way to change things until the end of the current transaction: SET LOCAL ...