It depends what email account he sent it to. It seems like at least Apple and Google are both using F-Secure.

So it could be a bug in their definitions files.