Note that you can list a password-protected zip file without knowing the password, which will allow you to ban zip files containing executables.

James and I think this is the best solution anyone has suggested, so we're now doing that and it seems to be working so far. Thanks :-)