It sounds like you've covered the bases, but let me just go through the checklist of things we did to get this to work. Also I'm confused about the embedded password. You don't have a password on the .csv file I assume.
1. The server is set up to run as an active directory user (not as the default Windows network server).
2. That user has permissions to the .csv location
3. There is no firewall rule preventing the server from accessing the .csv location
4. The .csv connection in Tableau desktop uses the UNC path, not a drive letter.
5. The include external files box is not checked
If you've verified all these things, then a support case may be your only answer.
1, 2 - Yes. The server is set up to run as an active dir user and the tableau server user id has full control of the destination
3. No firewall
4. Correct. Full unc path
5. The include external files box is unchecked when I publish. I download the published workbook, open it with Tableau Desktop and try to re-publish, the box is checked by default. Not sure if that makes any difference. The embedded pass refers to the connection with the primary data source which is an oracle table and I mentioned just to provide the full overview of my actions
Hopefully the case I raised will resolve the issue