to answer your question: no. i do not see emailing the doc in inself causing this. but having many people with who knows what internet habits and state of anti-virus software modifying and exchanging a doc sounds like receipe for virus to me also. could be somebody deleting it but seems not likely. could you make it read only at some point for a test.
as usual i have more questions than answers...
anyhow, virus easy to prove so i'd have a look for the anti-virus scanner log. if you find it, case closed. while looking you will get feel for anti-virus setup at the place...
it shouldn't be making it thru the emails with a virus but maybe somebody left the door unlocked.
does everybody who touches the spreadsheet got up to date anti-virus? offer to help them over phone for free after your normal business hours if you are looking to get your foot in the door of this place...
'delete off the network' needs more defining. can you get them to show you exactly what happens. can you get them to cc you for a while on the form when it is in use. is this the only problem file? what is different about this and other files you exchange with other vendors. do you exchange any other modified docs with this vendor? who modifies the file, exactly? what does the vendor think is happening? can you make doc read only and force people to modify copy locally? can you try another file name? i'd want to take a look at the exact location where it lives on the network and folder permissions and stuff.
event logs always worth a gander.
