Looking back in my long rambling answer I noticed I never answered the direct question "where did the other shares go".
They were discarded BEFORE working. cgminer records that as DW
I figured that much, but thanks for the long answer

I find the most useful metric is U (Utility. How many ACCEPTED shares per minute do I generate). A high U(tility) means high revenue. U is subject to variance so I really only look at it after cgminer has been running for 4 hours+.
With my 3x5970 rigs I try to maintain ~30 shares/min. Man I thought this one was going to be short ... failed again.

You're such a fountain of wisdom! That was the one question lingering in my mind, what that "u" meant exactly. Intuition told me it was a good proxy for performance.
BTW, 30 shares per minute, so 5 per gpu ? Seems lowish to me. Have you underclocked and undervolted those 5970s? Thing is, Im getting exactly 5 share per minute per core on average with my considerably cheaper (*) GPU cores (and not even seriously overclocked due to linux limitations).
(*) okay, they would have been cheaper if I wasnt so anal about keeping temps low. If I factor in the cost of that spitfire and the other coolers, its not that cheap anymore, but the ease of mind that 46C peak temperature on the 5870 @ 900 MHz gives me is priceless

.