See http://civicrm.stackexchange.com/questions/10169/dedupe-rule-for-organization-always-firing-on-membership-signup-form, with problem replicated on dmaster.demo.civicrm.org. I replicated on a 4.6.10 installation when making donations as an unauthenticated user with same on behalf of org name and different postal code that the org created by first donation was updated with information despite no matching on unsupervised rule. Bug appears whether or not same individual contact is making donation - seems to be that just Org Name is used rather than Unsupervised Rule.
If there is no match for configured unsupervised rule for orgs, then the on behalf of organization should be created rather than an update be done on org that matches just on Org Name. An automated test should be added for this.