Turns out the issue was a permission to WRITE the email field on the lead record in Salesforce.com.
For some reason Christine's Marketo User robot in SFDC couldn't write email addresses on Leads, and therefore caused this nasty glitch:
- A new lead would come in from a Marketo form w/email address
- Marketo would insert the lead in SFDC, but leave the email address blank (since it couldn't write it in SFDC)!
- Next time Marketo would sync to SFDC, it would see a blank email address and DELETE it in Marketo too!
Ouch.
The issue was resolved by changing field level permissions in SFDC on the email field (letting marketo write it).
The good news is that the email address got recorded in Marketo's "Activity Log" - which isn't elegantly accesible, but is better than losing them all forever.