Some further information (for some reason I can edit a post immediately after posting but after a while it won't let me edit it?).
The IPN option under the Customers drop-down correctly shows just those payments that have been made successfully.
They show a TransID but no Parent Trans ID. I can confirm that this issue has only started happening after switching from IPN to Express Checkout.
Since discovering the problem, we have had a few more orders. Some paid, some not, but all set to processing.
We retested the flow, and again from the end users perspective all is fine except no money is taken.
Accessing /extras/ipn_test.php I get "Illegal Access".
Accessing /extras/curltest.php and data validation was good.
When we noticed the probm, I switched on logging.
Looking at those logs today I notice that that I was previously getting log files prefixed Paypal_CURL_EC, and now that I siwtched on logs I am also getting files marked Paypal_Action_EC.
I have all logs since I switched on logging in a zip. Looking at the time stamps, I seem to get 2 or 3 sets of logs per customer, e.g. more than one combo of Paypal_CURL_EC and Paypal_Action_EC.
I have also, done a screenshot to show the actual chronological order they were in as that will not be preserved in the Zip.
I would rather not post full logs to the forum as it contains customer data like addresses so could anyone wanting to help please PM me for a link?
Thanks.