My first thought is anti-virus and a desktop configuration (maybe preview pane?) that is triggering a local scan of the attachments.
A problem with a pattern file release could cause something like you describe. If that’s possible in your environment, you might look to your AV vendor.
Curious – was “<500MB” a typo – that’s a pretty big attachment in my book!?