Yes FvM, it is a mystery to me as well! This is a development board that was sent to me with the flash already programmed and in this state. Why they elected to not provide JTAG access to the Cyclone part is beyond me--there is plenty of room on the board.
Anyway, thank you both for the ideas. I think the first thing I will try is to get JTAG access to the FPGA (luckily it is a pinned part and not a BGA). If that doesn't work, I'll either try the direct USB-Blaster method (or just order a ByteBlaster-II) or use the GPIO header from another Cyclone board to re-write the protection bits by hand.