Ok, answered my own question. Just in case it helps anyone else:
We have a FooEJB.jar in the deploy directory that contains all of the bean classes. It's created by an ant task that specifies file filters to catch all of the bean classes. We also have a FooServer.jar class that contains all of the necessary helper classes in the lib directory. We had an anonymous inner class that was being created for one of our bean implementations (not sure why), and it was mistakenly being packaged in the server jar instead of the ejb jar. When the bean tried to access its inner class, we got the IllegalAccessException.
As for the duplicate class loader, no answer yet...