with utma, utmb, utmz and utmc being exactly the same as the ones in the bad request
sorry but I'm not sure that the google analytics cookies are enough to identify a request.
If not (or if you're not sure) try to identify requests through the LS4_XXX_CE cookie, (where XXX is a random number): such cookie contains a timestamp that should be enough to identify a request:

LS4_198_CE=1267107938515|N|<OUR DOMAIN>_198_CE

Obviously if those requests are just duplicates of actual requests minus the parameters, them should not harm the client, but if your client has issues, than or such issues lies elsewhere or those are not duplicated requests.

I don't know anything about their network infrastructure, but obviously if something in the middle removes parameters from http requests we can't do anything about that.