Thanks for your help!
I think the answer is this: Internet explorer uses WinInet functions. WinInet has an implicit session state which is kept per-instance (this is the hard-to-find information, I found one or two blog posts mentioning it). This session state includes the proxy authentication information. So the above functions will work, when used from within the same process, but they will fail if used from a child process, becaues it seems the HINTERNET handles cannot be inherited from a parent process to a child process.
The solution is to employ some sort of IPC between the child process (making requests to the parent process) and the plugin's main process (which is the internet explorer process and thus can perform the real downloads). However, I have not implemented this yet.