Microsoft.Web.Services3.SoapContext.Current is null in my [WebMethod],
so IdentityToken is inaccessible.

Okay, but you actually did give me something to think about:

[WebMethod]
       public string EchoTest(string message)
       {
           string echo;

           UsernameToken token = null;
           SecurityContextToken securityContextToken =
RequestSoapContext.Current.IdentityToken as SecurityContextToken;

           if (null != securityContextToken)
           {
               token = securityContextToken.BaseToken as
UsernameToken;
           }

           if (null == token)
           {
               echo = message + " - said goodness knows who.";
           }
           else
           {
               echo = message + " - said " + token.Username + " " +
token.Password + " " + KeyMaster.GetUserType(token) + " " +
KeyMaster.GetUserLocation(token);
           }

           return echo;
       }

Works!

I noticed though, when putting things to the Any property of the
UsernameToken (type of Microsoft.Web.Services3.Xml.ElementList) -
although on the client side you might have more then one thing in the
list, it seems that only the first element is ever serialised and gets
back to as far as the webservice.

I got around this by creating an XmlElement that has the things I want
as child nodes of the first thing in the ElementList (taken care of by
that KeyMaster class).

Anyway as far as I am aware all of the above doesn't use anything that
is obsolute.