Mystery solved. The user was using GNU screen, starting the process, detaching from screen, and terminating his original SSH session to the host (which, with our PAM config, destroys creds). I've pointed him at our build of krenew.