Here are two more "long shot" explanations:
The external program can call fm authority_check to check auths of users before executing it for them. This can be tricky because the FOR USER import parameter makes foreign auth checks but sets sy-subrc for the caller. Trace will show a "reason code" but this will be for the external caller context and not the dialog user who is being called back to. This is useful for simulations but not for admins..
If the program used LDBs and the driver program has authority-checks in macros, then these cannot be debugged (easily) and dont show up in the user's own trace either. This can also in rate cases lead to the conclusion that certain batch processing can only possibly work with SAP_ALL.
@ Lukas: which saprl, sp level and kernel are you on? There are also some new sneaky features which are new.
Cheers,
Julius