Q:

What (if anything) could have caused all three shuttle main engines to stop at the same time?

From my previous question, you'd have a bad time if it happened.  What could cause it to happen, if anything?  My parameters are:

The engines must STOP, but not destroy the vehicle simply by having stopped.  That is, they cannot explode
The vehicle may be destroyed as a consequence of other effects, like huge aero forces
I'm OK with answers that consider different times in the launch with different failure modes.  For instance, I can imagine that contaminated fuel (maybe?) can cause the engines to not ever start in the first place, while a small but significant explosion during MaxQ could (maybe) also cause the failure.

A:

There were a few common cause, credible failures.

Loss of inlet pressure to the engines due to a leak in the External Tank or failure of the tank pressurization system.  (This loss of pressure is what caused all three engines to shut down during the Challenger accident, when the External Tank ruptured)

Engine   operation   was normal  until  the  fuel  inlet  pressure 
  dropped.  As  the pressure decreased, the engine responded in a
  predictable   manner.   Automatic   shutdown   of engine 2023 was
  verified by telemetry data. Data recovered from the salvaged engine
  2021 control computer verify that this engine also had begun shutdown.
  Salvaged control computer data from engine 2020 showed that this
  engine was within 20 milliseconds of shutdown when the computer
  stopped.    Inspection    of    recovered    engine hardware  verified
  that  all  engines  were  shut down  in  a  fuel-lean  or  oxygen-rich
  condition  which resulted in burn through and erosion of the engine
  hot gas circuits.

(Rogers Commission Report)

Fratricidal damage from an engine explosion, gaseous oxygen heat exchanger fire, or an uncontained turbopump failure. (The engines were quite close to each other in the engine compartment with no shielding between them).

(personal photo of the engine mounts, looking into the Orbiter aft compartment from outside)

Early in the program, there was a known failure mode where the disconnect valves in the pipe to the External Tank could slam closed, cutting off all flow to the engines.  Pneumatically operated latches were added to hold the valves open after the Challenger accident.

(schematic from the Ascent Pocket Checklist, annotated by me)

Early in the program, loss of helium pressurization to the seal in
the High Pressure Oxidizer Turbopump due to helium leakage or rupture of the composite overwrapped pressure vessels storing the helium.  The engine controller monitored the seal pressure and would shut the engine down if the purge was lost. (Later engine redesigns eliminated the actively purged seal from the pump)
Early in the program, problems with the Turbine Discharge Temperature
sensors. Erroneous readings from these sensors caused one engine to shut down on mission STS-51F and nearly caused a second shutdown. The sensors were common to all engines and could easily have caused all three to fail. (The sensors were later redesigned to be more robust).
Running out of propellant. Sub-causes:

Performance problem with one or more engines causing excessive consumption of one propellant
Leak in the propellant system
Human error by launch control personnel - this nearly caused the vehicle to launch on STS-61C with inadequate External Tank propellant loaded to make it to orbit. Propellant depletion sensors in the feedlines would have detected the loss of propellant and caused the onboard computers to shut down all three engines. 

On January 6, 1986 during the second launch attempt of STS-61C, the
  MPS liquid-oxygen inboard fill-and-drain valve was not commanded
  closed because the liquid-oxygen (LOX) loading automatic  sequencer
  (terminal countdown sequencer / control software) did not receive the
  closed-switch indication from the replenish valve as required by the
  prerequisite control logic. This resulted in the automatic sequencer
  initiating a hold at launch minus 4 minutes 20 seconds. The ground
  operator verified replenish-valve closure using flowrate and other
  parameters, but did not close the inboard fill-and-drain valve prior
  to issuing the resume command to the automatic sequencer at launch
  minus 2 minutes 55 seconds. This allowed LOX to drain back out of the
  external tank through the tail service mast vent-and-drain valves
  until the ground operators noticed the inboard fill-and-drain valve
  was still open and manually closed the valve. Although unknown at the
  time, approximately 14,000 to 18,000 lbm of LOX had been inadvertently
  drained out of the external tank.
Another hold was initiated by ground personnel at launch minus 31
  seconds to review the previous out-of-sequence loading termination and
  obtain a 5-minute liquid-oxygen drain through the main engines. During
  the hold, the liquid-oxygen main engine temperature dropped below the
  engine start requirement of 168.3 degrees Rankine by approximately 3
  degrees. The engine limit was exceeded because the amount of LOX lost
  overboard through the fill-and-drain valve caused the colder,
  more-dense LOX to be drawn in from the external tank. The countdown
  was recycled to launch minus 20 minutes and oxygen replenish flow was
  reestablished. The launch was scrubbed when it was determined that the
  vehicle could not be recycled within the allowable launch window. If
  the launch had occurred, the reduced LOX quantity in the external tank
  would have caused early SSME shutdown due to LOX depletion resulting
  in a Trans-Atlantic Abort Landing (TAL).

(Source - you have to click on 61-C at the left to read the writeup)
More far-fetched perhaps:

Software error in the General Purpose Computers causing them to issue
erroneous shutdown commands
Software error in the Space Shuttle Main Engine Controllers (SSMECs)
Multiple Alternating Current bus failures causing loss of the SSMECs
Combination failures of things listed above
Crew error

