That's exactly what IS happening. I've had this issue with some software used by our company (written by someone else, [thank you, Jesus!]).
IIRC, What I did was write some code that first replaced "&" with a unique string, then replaced all occurrences of "amp;" with a null string, and then converted the unique string back to the correct HTML entity ("&")...