I don't know what or why, but I stripped back my original code to the core request (which is to get a list of subsites from specific site collection) - the code now seems to work for my colleagues! Bizarre...
It's also uncovered another issue with how I implement security trimming, but I can deal with that separately...
Thanks for your help!