I should have payed more atention to the tag documentation, the answer was there.
So, by default, it reads the messages from the request attribute named Globals.ERROR_KEY, and setting the "message" to "true" makes the tag read from Globals.MESSAGE_KEY.
Unfortunately, this brings another problem:
- saveMessages() saves to Globals.MESSAGE_KEY
- saveErrors() saves to Globals.ERROR_KEY
- the messages returned by an ActionForm.validate() will be saved to Globals.ERROR_KEY