Well, I posted here after failing to find the info in forums or via google, but the friendly folks @ #proftpd (which I've just learned about) had me add "PersistentPasswd off" which worked like a charm. Explanation below as it was given to me:
I think the netinfo service in OSX is like NIS
and so the advice in the proftpd docs
about PersistentPasswd
apply to OSX as well
it's a name/acct service, as opposed to a static file
and the PersistentPasswd directive tells proftpd whether to keep a file descriptor opened on that, or not
for a service, keeping that descriptor open makes no sense
but there's no way for proftpd to be be able to know what kind of acct source it's dealing with
that is all hidden by library access functions
hence why it's necessary to manually tell proftpd, via this directive, what it should do