I eventually discovered the problem was also clearing the user’s checkout basket. Upon realising that I discovered the user’s session was dematerialising on the server-side as well.

A few google’s later I found this post on the Magento forum (finally their forum is useful):

http://www.magentocommerce.com/boards/viewthread/27475/

So basically there are options in Magento’s admin backend that cause disruptions in IE for sessions and result in user’s losing their entire session.

In my case it was disrupting Ajax calls all the time. Why have the Magento developers made a buggy set of options the default for the admin panel when the bug affects the most common browser in existence?

Those options do sound great in terms of security but until they’re stable and tested they shouldn’t be made the default.