The problem (to me) is clearly an issue of Anope interacting with UnrealIRC in a latent response. Anope informs the client that they have been authenticated, and then Anope informs UnrealIRC that it should +r the user.

I informed #anope on that they should perform this operation in reverse -- first setting the user +r and only then informing them that they've successfully authenticated, so that clients can react to NickServ "Password accepted" messages.

A work-around would be to add an N second delay to reacting, or add a behavior for UnrealIRCd to check for "* NickServ sets mode: +r" messages instead.

Well. At least I won lunch.
Good philosophy, see good in bad, I like!