Hi Emma -
See my above response to Fred - Cron is running every minutes, so it has had ample opportunity to unenroll the user.
I took Fred's advice and re-saved the settings on the enrollment page, and - fluke or not - things seem to be working properly now. We'll chalk it up to gremlins and move on, seeing as how I cannot reproduce the issue.
Thanks to Emma and Fred for their helpful responses,