The file is sent to the client using Response.writefile and the content drawdown as inline. When the user selects Save As, they are prompted to authenticate with IIS again, even if anonymous access is enabled.
Assuming I would suggest looking at the ownership of the Excel file. Presumably it should be read / write to IUSR.
What is the path to the file when writing it?
Do users have proper rights to create files?