The src/test/java/hudson/plugins/git/GitSCMTest.java includes tests that check culprits are set as expected, including single value culprits and multi-value culprits. Can you explore further to see what might be different between your environment and the environment that is used in the plugin automated tests?

What should I look for? I am not sure how I would determine this.

I ran your script with a Freestyle job on my controller that had just built after polling for changes and detecting a change. The job reports that it was started by an SCM change. The script I used was:

jobName = 'Hosting-Providers/github/github-bin-https'
myJob = Jenkins.instance.getItemByFullName(jobName)
lastBuild = myJob.getBuildByNumber(6)
cset = lastBuild.getChangeSet()
println "cset = $cset"
println "cset.getItems() = ${cset.getItems()}"
culprits = lastBuild.getCulprits()
println "culprits =$culprits"

The resulting output was:

cset = hudson.plugins.git.GitChangeSetList@7996e9cf
cset.getItems() = [hudson.plugins.git.GitChangeSet@3654bfe2]
culprits =[mwaite]

My Freestyle job detected changes when polling and included those changes in the job. Your job (unknown type) was triggered by an scm change but the list of changes was empty. I think there must be some difference between your environment and the test that I performed.

I created a vanilla instance of Jenkins from a war file.
I created a local git repository accessible by the path to the repo and a remote repository in a Gerrit instance.

The initial poll did not show changes or culprits but the next poll after an update did correctly show in the changeset and culprits
There may be an issue with interference from other plugins or how the remote repository was updated.
I will close this issue and continue to investigate on my end.

Testing in a stripped down version of Jenkins with test repositories behaved as expected.