Thanks, Greenman. The settings available to me seemed correct, but I was awaiting the original link to do some testing. The sender has now said that the removal seems to have occurred at his end, possibly it's his AM that's over zealous.

I'm still a bit puzzled that one email client re-saves the CNM file on the server and the other doesn't, but it's not causing any issues so I'll consider the thread complete.

I received a message which was sent with a hotlink in it, but the link has disappeared. The sender resent it, and the link was removed again. Investigating, it appears that this is caused by the mail client. When I read IMAP messages on my Mercury server via Thunderbird on a PC, they are not changed and the date/time on the .cnm file in Mercury matches the receipt time in the headers. When I read the message using the Android email app on my phone, the .cnm file is re-saved to server at the time I read it. It appears that the Android client in this case modified the message by deleting a hotlink. On reflection it may not have been the mail client, it may have been the anti-virus app (Avast). I'm awaiting a further resend, so that I can do some testing.

 Has anyone seen this before, or have any knowledge on whether this behavior by a client is valid under the IMAP specification?

Sounds like over-zealous anti-malware software to me. Check your anti-malware configuration settings for email/SMTP.