My test showing the difference was on Ubuntu 12.10 so it's not specific I think. What I don't know is if this is normal operation or a bug, but I would guess normal operation otherwise it would be being shouted from the rooftops.

What does the actual sudoers file have in it? Perhaps it's an order thing, for some reason the (ALL:ALL) ALL is getting matched first?

So package data is corrupted now. Either just stop it and ignore it (if you ignore any problem it goes away) or fix the package data, probably with a reinstall then a remove.

I think I've been pranked. +1 to my lab colleagues for a Linux prank. -1 to me for leaving the screen unlocked. Don't think I've been compromised, well at least I hope not - everything else looks well. Thanks to all for your answers.

OS is CentOS 6.3 Final, Kernel is 2.6.32-279.11.1.el6.x86_64, command-line expansion through tab if I put in a full directory name and type/more etc again if I put in a FQ file path work fine. If that helps.