Some moodle files appear to have BOM markers in them. Under linux, they can be seen at the top left of some pages. They look like this:
I've seen them in the 1.9 checkout I've made for testing, in one of the install steps, and on the Network Settings admin page at least. I suspect if there are BOM markers on those files there may be more elsewhere.