When Windchill generates a URL for a download, it creates a signed, one time use URL. If a client begins a download through the URL, then the connection is interrupted, and the client attempts to reconnect/resume the download, then Windchill will throw a security exception since it sees the (one time use) URL as already having been used. My guess is that this is the problem you're running into.
This behavior can be disabled, to allow a generated download URL to be re-used. This should allow the download manager to successfully reconnect/resume a download if it loses the connection. To allow a download URL to be re-used, you just need to set the below property in wt.properties:
wt.intersvrcom.URLAuthenticator.useUrlCache=false
In addition to the above, the download URLs generated by Windchill are only valid for a certain time period. If the download is attempted outside of this time period, a security exception will be thrown and the download will fail. By default, the allowed time period is for the five minutes after the URL is generated. However, you can adjust this period through the property wt.intersvrcom.security.graceTimePeriod in wt.properties. This should be set to the number of seconds you want the download URL to be usable (e.g. 3600 for an hour).
From security perspective the one time use of a URL is a preferred security measure to prevent unauthorized retrieval of data well within the grace time period. So, it's not recommended to change these properties. But if you feel there is no risk of unauthorized downloads at your site, then you can play around with these poperties and see if that allows the use of download managers. I'm not aware of Windchill every having been tested with download managers, so I'm not sure if it will work. But, I can't think of any reason it wouldn't work, after changing the above properties.
One other thing to add: If you're using replica sites, you'll need to set these properties at both the master and replica sites.
