I can't reproduce this, the thousands separators are rendered as 
spaces in French here.

Actually, after looking more carefully, I'm not sure it's in the 
translator's part (sorry, only beginning with .po, even though I've 
wanted to look at them for years)

From what I understand, the number with invalid chars is outside a 
gettext tag:
./templates/compose/compose.html:
       (<gettext>Maximum Attachment Size</gettext>: <tag:attach_size 
/> <gettext>
bytes</gettext>)

attach_size is generated there:
./compose.php:
         $t->set('attach_size', 
number_format($imp_compose->maxAttachmentSize(),
0, $localeinfo['decimal_point'], $localeinfo['thousands_sep']));

And it comes from NLS::getLocaleInfo() which uses PHP's localeconv(), 
so 'thousands_sep' is a PHP constant, right? And I suppose it lacks a 
conversion from ISO8859-1 to UTF-8.

Usually the last. And he's mentioned in the po file.

Ok, I thought they would use the bug system, too.
Is the last one the first or the last in the list?

Please talk directly to the last translator.

When writing a new message using the French GUI, the max allowed 
attachment size is shown as such, with the invalid chars symbol "white 
? in black lozenge":
(Taille maximale de la pièce jointe: 2&#65533;097&#65533;152 octets)

It should be a no-break space.