Found it...
It was caused by a bunch of Rewrite rules in the apache config. I don't know the back-story but my colleague had added them on the recommendation of some posting in the Moodle Partner forums for fixing some reported vulnerability. It obviously breaks TinyMCE but we might well be the first to try this combination.
Oh well.... thanks for all your suggestions. In a round-about way you all helped a lot