He shouldn't be opening email attachments at all unless he:
The same goes for any URLs in email.
He’s trying to run a business, so he has to open a lot of suspicious documents. Not everyone can afford to throw away may from people they don’t know.