Unfortunately, it's not a rule that is putting the mail in to quarantine, hence the post.
It is a mail attachment, being classed as a virus, when it is not.
It's happened to various users but maintaining rulesets for each domain/user and from or to address becomes a mammouth task and could...