Don't beat yourself for this mistake. We had a similar problem with emails where the provider was adding tracking URL by default. We had no idea until a client complained that it was blocked by their firewall/network. We then had to turn that off option which is enabled by default. Sneaky.