OK, I realise I’m basically talking to myself here but I seem to have resolved it and thought I’d pass it on in case anyone else gets the same issue.
All it took was to reset the MQTT password for the emonpi user to the default ‘emonpimqtt2016’ (even though I never changed it)
sudo mosquitto_passwd -c /etc/mosquitto/passwd emonpi
this allowed subscribers on other machines to connect to the broker anonymously?!
Currently allow anonymous connections is set to TRUE in MQTT config on emonpi and I’m reluctant to turn it back to the default False in case I break it. So my Openhab MQTT config isn’t using any credentials and can connect just fine.