I can't speak to why the results are different, but "Find all Work Orders that were created from Sales Orders created by the Web Services user" should look something like:

s.create({
  type: WORK_ORDER,
  filters: [
    ["mainline", IS, true], AND,
    ["createdfrom.createdby", ANYOF, webServicesUserId], AND,
    ["createdfrom.type", IS, SALES_ORDER] // might be recordtype instead of type
  ]
});