I think our problem may be licked. I finally had an opportunity to observe a client machine for a solid hour while it exhibited this problem. The problem went away after I killed Trend Office Scan on the client machine. I felt silly for not having tried this before--it wasn't that many years ago that you blamed the virus scanner first for whatever problem cropped up!
The problem was alleviated (hopefully--not all the evidence is in yet) by defining mime types in IIS on the SP server, so as to identify an .xml filetype with the Infopath application. Before making that IIS change, the user would get a Open/Save/Cancel dialog whenever they tried to open the form from an emailed link, and I believe that the same mechanism that opened the dialog was triggering Office Scan. Most of the time, this created no problem, but on some percentage of events, Office Scan would not release the file, or was contending with Infopath for the file, hence the freeze-ups.
Hope to confirm or deny this theory in the next few days, but in the meantime, things are looking up!