OMG, do I feel DUMB! The "Check permissions" checkbox in the System settings was checked!!
I had trawled through all the settings between sites so many times but completely missed that. I even completely deleted the sitemap page and recreated it from scratch, so that Check permissions setting must be set to True by default!