I've spoken to Mike about this, apparently the lock is held much higher in the call chain (EnterUserExclusive), which isn't obvious in the patch.
Locks?