Ampersands aren't valid in this context.
If you "encode" them yourself before Outlook can.. it will switch it back to normal for you:
<a href="http://www.foo.com?qs1=example&Code=%CODE%&Email=%EMAIL%" />
So you use amp;
, and Outlook will fix it. Browsers do the same thing.
Even if it doesn't look like it in the page source.. if you click the link the amp;
will be replaced with a normal ampersand.