Turns out to have been that the ip_conntrack_ftp (ftp connection tracking) module was not loaded, so now it is.

It's a mystery to me why it used to work but then stopped. And also how the hell they (Plesk) can distribute their management software so fundamentally broken. I suspect they don't, and that somewhere along the line someone (that'd be me or Paul then) has inadvertently broken it, but lawd knows how.

Simon, thanks to you as well for your help.

--