Thanks Kevin!
I've disabled the Agent and User timeouts. (We actually have no users that aren't agents. Everything on the front-end is pretty much dead/disabled. We do email-only support.)
Unfortunately, it's not something I can easily reproduce. These are end-users in other locations reporting stuff after-the-fact. It's all completely intermittent, and honestly only happens rarely - I haven't seen it happen in person, but it happened today with a single user 3 or 4 times in a row, and that pretty much panicked everyone. (This is a trusted, competent user here, so we know what they are telling us is true.)
The human challenge here is that, "This doesn't happen with other systems." So these users are experiencing a failure that they DO NOT experience with any of the other systems they use daily.
I don't know what to say. I hope this session timeout thing fixes it. (And if it does, you should probably look into why it's happening with limited session timeouts...definitely a software issue in that case!)
A thought/note: We previously had a different timeout for User sessions than Agent sessions. The Agent timeout was longer. Could something regarding attachments be related to the user timeout? Like the Agent still has the session, but the attachment is tied to User timeout, so it fails??? (I say this, because when I tried to "close" the front-end by limiting User/front-end portal to only a certain IP through Settings, it did indeed BREAK attachments for Agents on the backend trying to download...they could not access the attachment URLs because the front-end was blocking their IP.)
It does seem that the system has at least that know issue, where agents should have been able to access attachments regardless of the front-end being "locked".
I hope this helps...