Hi Mathew,
Your screenshot doesn't actually show that there are no role overrides. It is for setting which roles are able to override other roles (for example normally a teacher can override the roles of non-editing teacher, student and guest).
Although roles and capabilities in Moodle allow many different possibilities, they are rather complex and a challenge to understand sometimes! To figure out what has happened on your site, you'll probably need to look in a lot of different places.
How about going to 'Check permissions' in the assignment administration and selecting one of your students. It will tell you which roles the student has. This can be useful because one reason for users gaining extra capabilities is that they are assigned an additional role.