Okay, I've set up a password protected directory within my main site, and within that directory I've got WP in development for a client.
The client can therefore access WP with the password and see what's going on.
I think the password protection has wiped the .htaccess. Every child category I go to shows exactly the same posts, even though the permalinks in the address bar change.
Within WP, I can change the permalink 'styles' around (e.g. default, custom etc.) and WP accepts this quite happily, so it can't be having any trouble in overwriting the .htaccess.
The pastebin is here: http://wordpress.pastebin.ca/931080