OK we have now realised that some of PayPal's servers are terminating at the first ampersand. This explains why we get the first query string value but not others.
It seems this behaviour is not just limited to notify_url value but as is suggested by Mike in the comments, this is happening with the CUSTOM field too. If you're pushing through a series of name value pairs with an ampersand separator you need to either switch to some other separator or URL Encode the whole value.
We're just now testing to see if URL Encoding the whole callback URL will still result in an actual callback being made.
EDIT:
Yes URL encoding the whole notify_url value resolved the issue and preserved the query string.
EDIT 2:
It seems URL encoding the whole value no longer works, so I'm assuming PayPal have reverted back to the original behaviour before we encountered these problems. Hopefully this will be consistent across all their inbound servers and will remain fixed now.
