I finally got to the bottom of this issue. Here's what I did.
If you can't reproduce an error, try to see what the client sees.
A quick Google showed me those vars point to firewall issues.
Check location is not just (Site Name) but actual (Site URL).
I then asked her what the URL she was using, and the URL had the same strange variables in it too.
Ok, so the URL was setting the variable in the first place, for the firewall to accept.
I had her use the proper URL and the page seems to work correctly!
I'll have to dig into the firewall to make sure the site filters correctly, but I'm 100% certain that is the issue, and now I can actually find the solution.
It will likely end up being a combination of firewall settings and client education.
The biggest issue was not knowing which direction to search. You helped me rule out some other possible scenarios.
Thank you all for your views and ideas.