How to troubleshoot documents being stripped from emails.

A user at my office receives documents with a PMT extention from a bank for an accounting program.  Everyday she recieves a new file named for the date the file was created, for example, ABC040105.PMT.  On 3 occations March 3rd, March 18th, March 28th the emails have been blocked.   All the files are anywhere between 70KB to 250KB in size.  We attempt to re-send the file again and again it does not show up.  We had a sneaker net version of the file via snail mail for the 18th and I have been able to attach it to a plain email and send it via Intranet.  I had my coworker attach the document to an email and send it back to the bank, and the bank was able to send it back to my coworker with no problem.   The March 28th file is now not going through.  March 29th, 30th and 31st are all fine.  
In mid February, we upgraded our server hardware and software from 2k to 2k3.  Prior to this upgrade, we have never had any file stripped or blocked and I think it may be coincidental.
What is the best way to determine at which point the email is getting stripped, (i.e. their firewall, our firewall, their outlook, our outlook, etc.)?  Is there any way to retrieve deleted attachments or are they gone for good? And is there mail rules in active directory or on the server that can be causing this?  If so where do I look?