Outlook Web Access and attachments

We are running Outlook Web Access as a remote client for an Exchange Server (sp3).

When our remote users try to download an attachment using Outlook Web Access (sp3), they are prompted for a username and password. After entering the details (sameusername/password they used to log in initially) the download is refused.

What’s going wrong?