Michael,
thank you for the suggestion about ProcessExplorer. With this, I was able to find the the 3cx EventLog.dll was in use by the Windows Management Instrumentation process wmiprv.exe. I have no idea why, perhaps you do? I stopped the service, and it also stopped Exchange Management. However, 2 wmiprv.exe processes continued to run, and in fact phoenixed themselves if I deleted the processes.
However, I ran the update whilst trying my best continually to delete the WMI processes in the hope that they wouldn't be running when it came to that dll. And it worked. So I record this experience for me, in case it is of use to others reporting the same issue/