Except for the fact the code was almost as old as I am (born in 1976) it turned out that the security check that the code was supposed to perform didn't actually execute.
Yepp, that's right, the code had been running for 30+ years doing nothing.
A friend of mine ended up doing the actual work so I don't know how the story ended but it's a good reminder to never assume _anything_ when you look for bugs.