A message with a suspicious attachment gets re-scanned only once when leaves the Suspect Virus Quarantine.
A message with a suspicious attachment is scanned by SMG the first time and then it is placed into the Suspect Virus Quarantine. After the specified time value, the default value being 6 hours, the message is released from the quarantine to be re-scanned using the virus definitions available on the appliance..
This behavior is by design.
The message will stay in the Suspect Virus Quarantine until one of the following conditions are met:
Note: The default value of 6 hours can be adjusted on the configuration page mentioned above. However, it is crucial to make sure the new time value is set in such a way that the appliance has enough time to download the latest AV definitions.
The available antivirus definitions will be used to scan the suspicious attachment once the message is released from the Suspect Virus Quarantine.