I haven't seen anything like this before, but it should be somewhat easy to narrow down (famous last words, eh?). In OpenACS 3.2.5, you want to take a look at /tcl/ad-admin.tcl. The routines to look at are all at the top of the file.
There's ad_administrator_p, and there's the filter, ad_restrict_to_administrator. For some reason, you're pissing that filter off.
Perhaps the easiest thing to do is to instrument the ad_administrator_p to log the user_id it's called with.
I would explore the query:
select ad_group_member_p($user_id, system_administrator_group_id())
What is system_administrator_group_id() returning? What does ad_group_member_p($user_id, system_administrator_group_id()) return?
