Seems almost too obvious to mention but it hasn't come up yet ...
The web server logs may be useful in tracking this down. Access logs should tell you whether the user is getting through. That may help distinguish a firewall block from a flaky connection. It might also help you tell how many connections are being opened - a bit less sure there. There might also be some kind of error in the error logs - worth a look I guess.
fg
|