For anyone who might come across this....

In my service before I called _formRecordSearcher.QueryDataBase(filter) I had to insert the line:

HttpContextBase wrapper = new HttpContextWrapper(HttpContext.Current);
UmbracoBackOfficeIdentity user = wrapper.GetCurrentIdentity(true);

...which i guess forces the user identity.

Also, for the filter model passing in, it looked something like this:

RecordExportFilter recordExportFilter = new RecordExportFilter
            {
                StartDate = request.DateFrom,
                EndDate = request.DateTo,
                Form = new Guid(request.FormGuid),
                SortOrder = RecordSorting.Descending,
                SortBy = "Created",
                ExportType = "",
                Filter = "",
                LocalTimeOffset = -120,
                StartIndex = 1,
                Length = 0,
                States = new List<FormState>()
            };

is working on a reply...