Here is the solution I found, I don't know if it's the best (it would be nice to capture symbology as well), but it does work and is straightforward. It's possible to grab a feature service and attachments and relationship class all in go from the server itself in a file-gdb.
Esri has updated the export tools. There are now two official routes that I'm aware of for exporting feature service data with attachments.
As a normal user
Navigate to the feature service's main about page (http://arcgis.com/home/item.html?id=xxx123456xxx
), and use the [Export] link at right side, select FGDB for output format, and you're done. (If the export link is missing, [Edit] and check the Export Data box first.)
Interactively via API
Point browser to http://services.arcgis.com/{xxx123456xxx}/arcgis/rest/services/{folder_name}/FeatureServer//createReplica
Set values to the below, unlisted items can just use default. Click on the resultant “statusURL”, and then “Result Url”, save zip file in wherever and extract a file-gdb with everything intact (except symbology).
Replica Name some_meaningful_name
Layers 0,3 (select by index number)
Return Attachments TRUE
Return Attachments by Url TRUE
Create Replica Asynchronously TRUE
Sync None
Data Format FileGDB
For interest, I also found a script to this the hard way, extracting records and attachments individually and recreating locally; see AGO_PullHostedFeatures.py by Owen Evans.