STM32F103 low power mode (stop)
Wilhelmsen and Chris were right - it was the circuit.

However, it wasn't resistors, external IO, etc. It was the LD1117 Voltage Regulator which I hadn't really considered before.

It turns out that pretty much all the 1A, 3.3v LDO voltage regulators I can find have a 5mA quiescent current. I've just soldered in a MIC5205 (which is rated for 150mA) and it now draws 0.12mA! \o/