It turns out I was confused by the netstat output. It marks joint IPv4/6 sockets as tcp6
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453272bitcoind was listening on IPv4 socket 8332 all along, but my client was failing to connect for other reasons.
With the IPv4 client able to connect on port 8332, my netstat output is:
user@server:~$ netstat -lp | grep bitcoind
tcp 0 0 *:8333 *:* LISTEN 7574/bitcoind
tcp6 0 0 [::]:8332 [::]:* LISTEN 7574/bitcoind
tcp6 0 0 [::]:8333 [::]:* LISTEN 7574/bitcoind