Ok...some results.
I tried a 100K resistor and got about 4V drop across it (the same as the 1M resistor - weird!)
I tried a 10K resistor and got 2.27V drop across it. That gives 2.73V across the chip, which is in the right range.
But...2.27V across a 10K resistor is .227mA - two orders of magnitude higher than it should be.
So I'm as confused as ever. Going into sleep mode definitely uses less power (I can measure the difference!) but consumption doesn't seem to be anywhere near as low as it should be.
FWIW my sleep code is:
set_sleep_mode(SLEEP_MODE_PWR_DOWN);
sleep_enable();
sleep_mode();
Brownout detection is disabled by fuse bits and the watchdog timer wakes the chip up after the correct amount of time (I've timed it).