strange nroff mystery

[MJ Rosenblum]

5.0.1 USG VAX, a different one from the /tmp problem. One of our supervisors
complained of strange happenings: he would nroff a file on one terminal,
a crt, and run over to a 450 to print it out, only to find it unreadable.
It was mode 600 and owned by root.  I couldn't duplicate the problem, but
it later recurred. I found 4 files in such state, and running acctcom on
the time period, discovered an nroff, 2 hp's, and an ed and another nroff
all with # flags.  Moreover, his login shell, when he logged off a few
minutes later had no such flag (all other login shells, of all comers, seem
to have this flag).  He was able to nroff the file on the 450 terminal,
This nroff did not have the flag, but the login shell for this terminal
did.  All paths were checked for strange nroffs, tbls, and neqns, but none
were found.  All the root-owned files were created by redirection of
stdout.  No chowns appeared in the pacct files, and no suspicious items
are to be found there.  His umask was set 077.  He is neither tricky,
nor a UNIX maven.  Any insights would be greatly appreciated.
	Thanx
		Marty Rosenblum