Microsoft Word performs a behind-the-scenes HTTP request when you ask it to open a hyperlink, in order to skip opening your browser if it points to a Word document (in which case it'll just open it directly). However, in doing so, it follows all redirects - and then passes the final URL to the browser upon determining that it's not a Word document.

If you're already logged in to the Moodle site in question, this means you'll end up being taken to the login page (because Word isn't logged in to Moodle) which will then display a "You are already logged in" message. If you're not logged in, you'll be taken to the login page - but upon login you'll be taken to the home page rather than the page that the link points to, because Word has the session which had $SESSION->wantsurl set.

Microsoft acknowledge this issue, but blame the rest of the world for it - suggesting that instead of correctly using HTTP redirects, you should return a 200 OK and use a meta-refresh and/or JavaScript redirect; see http://support.microsoft.com/kb/899927 for more detail.

To compound matters, only recent versions of Word identify themselves - and even then, usually identify more generically as Office rather than Word. Even so, we should do our best to identify Word and prevent the login redirect so that the correct URL is passed to the browser. Note also that returning a status other than 200 OK (a 403 Forbidden, for instance) results in Word spitting out an error and failing to open the browser.