Possibly just the fact that it's a password protected zip - would you ever expect to receive one of these normally?

Well, possibly I would, if someone had a genuine need to send me a Windows executable and couldn't get it through my mail filters any other way! I usually recommend that they put any large attachments on a website and send me the URL rather than the file, but there's always someone for whom that's terribly inconvenient...

I have a particularly nasty memory of the guy who mailed me a copy of PuTTY and said "I think this might be infected with a virus, can you shed any light?", and my automatic virus rejector bounced it straight back to him with "554 We won't let this mail in because we aren't confident it isn't a virus". The worst of it was, when I saw that one in the logs I went and extracted the binary and checked it carefully, and it turned out to be a perfectly pristine copy of 0.51; but the bounce he got probably didn't boost his confidence in it :-/

(Yeah, I know he didn't read our Feedback page and therefore it's His Own Fault, but even so I don't have to like that sort of result.)