Good question. 

I think I have seen this happen on occasion. The docs say 
that by default it has to stay in the specified branch 
(whatever you put in the "Web Addresses" (URL)" box in the 
project config). When it seemed to violate that default 
behavior I was usually able to cure it by doing what you 
did - add filters like

 "+www.example.com/mypage/*" and "-www.example.com/*" 

But remember, the "-www.example.com/*" should preceed
"+www.example.com/mypage/*" because the filter engine reads 
to the end of the filter list to find a 
permission/restriction. However, if you got that backwards 
("-www.example.com/*" last) you wouldn't get anything 
from "www.example.com" ; I think you are saying that it 
goes into "www.example.com/*" and beyond (external).

Also, you haven't specified anything in the "Web Addresses" 
(URL)" box in addtion to "www.example.com/mypage/" have 
you ? That could make it go beyond "www.example.com" in 
spite of your filters on  "www.example.com/*" .

So, I too await a more insightful answer from Xavier Roche.