The person who forwarded an attachment 1. from someone they didn't know 2. that they hadn't opened themselves are culpable. Prevention is better than a cure.