It would have to be mangling both the Content-Disposition and Content-Type headers.
If that's really happening (I have my doubts) and that's a client you want to continue supporting, then the next step would be limiting yourself to SingleFileZ-style ZIP payloads that can be as text/html.
SSL proxies -- corporate middleware -- have a habit of breaking this way, by stripping the content-disposition field or similar.