Steve, I'm not sure exactly how this is happening, but it sounds like something about your process is getting confused between HTML and plain text.
If I typed &id=X in a Wysiwyg editor, the HTML source for that would be
&id=X (actually, what I wrote over there to the left was "& amp;id=X" but without the space. It was interpreted as HTML and the "& amp;" was rendered as "&" - talk about illustrating the confusion - apparently I needed to use "preformatted" in this wysiwyg editor!)
Is it possible that some of the parameters for your site were cut and pasted from html and it snuck in this way?
Can you elaborate on when this occurs? E.G. is this manifesting in browsers, or in emails sent by CiviMail, or in some other way?