In that case, I'm very confused. Can anyone explain the behaviour I have observed? There definitely seems to be a limit on the XP machines I have tested on, as when I remove a user from some group, it disappears from the token cache and another group that the user is member of appears in its place.

Certainly, the token cache isn't listing all the valid group memberships in these instances and Ingroup returns 0 when it should return 1. I will do some more testing. Maybe I have jumped to the incorrect explanation but there is certainly an issue related to InGroup.