cory,

It is remotely possible that if the email was sent by Exchange, there may by actually two copies of the attachment within the email in different formats. The other (even more remote) possibility is that there were other different attachments in the same email, thus making the total size > 20MB.

I say "even more remote" as unless you are sending the email yourself, the end user reporting the problem may "forget" to mention that there were other attachments.

If neither is the case, you could try to enable debugging within SpamFilter to try to capture the connection data. To do so, you'll need to find the IP address of the mail server sending the email. Then go to the "Settings - Debug View" tab in SpamFilter, enter the IP to be monitored, and "Enable Debug Monitor". In the same tab, all the SMTP traffic to/from that IP will be logged, allowing us to see what is happening during the SMTP handshakes and what email content is being transferred.

Once you capture that info, if you can email it to us we should be able to find out more details as to what is happening.