Another day, another person having problems with PHP sessions and amersands in URLs. You'll need to follow through to the HTML part (HTML email is bad enough, but non-multipart with a text alternative? Argh!), but don't follow his solution, its borked.
Where was I? Oh yes, I was prompted to write a detailed explanation of the problem and solutions so I can just pump off links to people in future. Corrections, extra information and general comments (especially nice ones) welcomed.