CentOS - Feb 2008 - tar: no, the file did not change while you read it

CentOS 5.1, i686.

I have a directory, say "foo", containing several hundred directories
down
to about six levels deep, and about 33,000 files. Periodically I make a 
tar archive of the whole lot:

 	tar cf foo.tar foo

and I often get from a few dozen to several hundreds of:

 	tar: XXXXX: file changed as we read it

followed by an exit status of zero.

I am absolutely sure (100%, positive) that no files were changed during 
the period that tar was running: some of the files that are often flagged 
as changed have not been modified in many months, and have only been read 
by tar and the backup system. If I immediately repeat the tar command, it 
may succeed without any of these messages or flag a different set of files 
as changed, when again they have not. I'm sure from Googling that many 
have seen this. The system does also run Samba and the file system on 
which these files are resident is accessible from Windows clients, but 
none of these particular files are ever used from the Window side. The 
file system is also NFS exported, but again the files are not in use on 
any NFS client.

What is interesting (that is, suspicious) is that on upgrading (clean 
install) the system from a previous incarnation of CentOS 4.6 (which also 
exhibited the problem) to CentOS 5.1, keeping the same tar version 
(1.15.1) and making no hardware changes, the incidence of these messages 
has _hugely_ increased. I have also seen a couple of repeated instances of 
"stat <file>" return changed times that differ from one another,
and in
all cases the file has not changed at all: the difference in the reported 
change times is always exactly 5 hours (which is my offset from UTC). I 
can't reproduce that at will.

If anyone has a clue stick to beat me with, please do; it's getting 
a little old.

Steve