I traced it down. The corruption is occurring at groups.io - I thought it might have been my beta version of Thunderbird, or my local SMTP server, but I've verified my ability to send images to other sites and get them back. I just saw a case where OFA replied with an image, which was corrupted - the commonality is we both sent images to groups.io via email (as opposed to using the web page).

I can identify the form of corruption, if someone has a contact at groups.io - at least the initial failure is a "#" (byte of 0x23) is being expanded into several bytes, destroying the integrity of the image binary. I suspect it's something in the conversion from mime to binary where they got something wrong.