The easiest is to have your mailscanner configured to quarantine Whole Message as Queue files; from Chirpy with instructions for this and more, here.

Quarantine Whole Message = yes
Quarantine Whole Messages As Queue Files = yes

then to requeue the email to be delivered, you need to go to the indicated directory within:
/var/spool/MailScanner/quarantine/<date>/<message-id>/

Then you need to:
cp -av *-H /var/spool/exim/input/ ; cp -av *-D /var/spool/exim/input/
one done you’ll have to wait for the next exim mail queue run, or run it yourself from WHM > Manage Queue > <message-id> > Deliver Now

Mailscanner doesn’t like MS Office 2007 files because of the multiple extensions, treating it as a tricky archive. These files get quarantined, thus increasing your admin time. To resolve this problem:

Add a new line to filename.rules.conf (somewhere near the top)

allow   \.xml\.rel$   -   -

Make sure the 4 “words” are separated with tab characters and not spaces. This (along with its partner filetype.rules.conf) is the only place where tab characters must be used, as the regular expression matching the filename, and the reports (which are just “-” for an “allow” rule) could also contain spaces.

Solution from http://lists.mailscanner.info/pipermail/mailscanner/2007-September/078056.html

Check etc/Mailscanner/ directory for this file. Configserver installation, check /usr/mailscanner/etc.