Hello,
1) By default I doubt it, this would violate privacy of our users, so i do not think this is an option right now. If you must do this i would start by reading thought docs, this article show how to decrypt mailboxes (DO IT AT YOUR OWN RISK), once this is done you can scan all mailboxes as you pleased, anyway just don’t!
2) Well this is double edge sword, how do you determine if this file using this extension is wrong? I do not think you can do this based on file extension, this is why mailcow use clamd and user should use antivirus on their clients,… Anyway, I see two ways, use sieve filter something like (do not copy, this is written from my head, without validation
require ["fileinto","reject","body","regex"];
if anyof (body :raw :regex "filename=.*\.exe") {
if not anyof (body :raw :regex "filename=.*\.(jpg|jpeg|pdf|doc)") {
reject "TEXT";
or in Rspamd some information can be found in docs