Kill them all!
This is why I strip all Microsoft documents (and a great many other) attachment file-types at the mail server - the email is allowed through but the document is removed. It's a minor inconvenience as the users can go to another place and retrieve the complete email if they really need it but it makes everyone think before they open those malware gifts that arrive every day.
paymentdetails.docx = paymentdetails.pdf.js = paymentdetails.iso = paymentdetails.doc.html
Biting the hand that feeds IT
