Thanks to user in.the.dark on MSDN forums (http://forums.msdn.microsoft.com/en-US/sharepointdevelopment/thread/80be9abc-f9e0-49b6-8ebc-8f90ddbf27a2/), a workaround is to set the URL programmatically, like so:
using (com.company.Lists lists = new com.company.Lists())
{
lists.Url = "http://company.com/Clients/_vti_bin/Lists.asmx";
XmlNode listColl = lists.GetListCollection();
}
listColl now contains the subsite's lists, rather than the root site's lists.