RESOLVED!

As quickly as that, the culprit has been found.  It was an internal user that was using the process, and they have only just come forward.

Thanks anyway.