Hello Paul,
Many, many thanks for the fast response - I tried your advice and used the administrator login and it worked a treat!
We've added the original user to an admin group and that works as well now. No change in the values returned by the API calls, it must have been something obscure...