I have no idea what action causes the permissions to change. That's what I'm trying to find out.
You might try looking at the file modification time and work backwards from there. Talk to whoever was working on the file last and see what they were doing. Fix the permissions then see if they can reproduce the problem by doing the same steps.
This is on an HFS volume
Eh? Initially, you said this was on an Xsan volume. I was asking if you've only noticed the problem on Xsan, or if you could also reproduce it on HFS+? If you can, then the problem is not Xsan specific.