As a followup to this question, Contact last-modified date changed by read-only user - it appears that the source of the issue might be that a read-only user some how activated APEX batch jobs that appear to be part of the NPSP (non-profit starter pack); NPSP-info & NPSP-code.
Here's a screenshot of the Apex Jobs; note that under "Submitted by" that I've replaced the real "read-only" user's name with read-only, and my name with SysAdmin; everything else should be as it is seen in Salesforce:
Apex Classes listed above appear to be:
Of note is that on 2014-05-20 1000s of contacts were flagged with the read-only user's name under the last-modified-date field with a time-stamp of roughly 11:45ish of 2014-05-20. This time-frame paralleled a group training session, but it appears that the issue may go back to when the user first got read-only access. The events with the SysAdmin (me) match the time stamp (5/1/2014 8:15 AM) for the install of that package in installed packages reports.
What are these APEX jobs? How and where were they activated by the user? Is there a way to figure out what if anything they did? How do I kill them? Going forward, if they're not required, how do I hide and/or disable them from users?