A minor nit: If 'Quarantine Whole Message' is set to 'yes', the original message is quarantined in a file called 'message' in the same directory as the quarantined attachments. But there seems to be no attempt (in MS 4.23-11) to avoid a name collision between these, so if an attachment is called 'message', this overwrites the quarantined original message.