I think I may have found the cause of the problem where users aren't automatically logged back in when their authentication cookie expires...
When a user logs in (either through DNN standard, windows manual or windowssignin.aspx) a cookie called ".DOTNETNUKE" is placed on their computer which is valid for the period specified in the web.config (default 60 minutes).
When a user is sent to windowssignin.aspx (either automatically by the authentication httpmodule or via a direct link) their windows credentials are requested and a cookie called "authentication.status.0" (0 since we are using portal ID=0) is written with a fixed timeout of one hour (AuthenticationController.vb line 535). Whilst this cookie exists the authentication module won't re-check windows credentials.
Now... why have we been having issues??? - I suppose there is a chance that some how the .DOTNETNUKE cookie is expiring before the authentication.status cookie, causing the user not to be logged in, but since the authentication.status cookie is still present their details aren't being re-checked.
Resolution.... I have set the timeout of the .DOTNETNUKE cookie to 61 minutes, so DNN should re-check windows credentials and update the .DOTNETNUKE cookie before the .DOTNETNUKE cookie expires, hopefully meaning we never have a situation where the sure is not logged in.