The attachment extension comes as html, which is often not included in gateway filtering rules.

The body of the message may include:

"Hi (Name) my valentine, remember me? I ain't seen you in ages! Anyway, check-out and play the attached guess-the-number-game to guess who I am. See you soon, bye-bye!"

GuessGame.html or GuessGame.vbe

The attachment does not run as a part of the restricted site zone in IE as a result trust zone protection is irrelevant.