Here's what ZA labs forum admin wrote:
"ZoneAlarm's MailSafe feature detects e-mail attachments and alerts the user to their presence. When a potentially dangerous attachment is detected (POP3 and IMAP protocols), ZoneAlarm quarantines it by changing the extension so that it cannot be executed accidentally. For example, a file called SERVER.EXE will be renamed SERVER.ZL9 if you have chosen to quarantine files with the .EXE extension. (The file itself is NOT moved).
To open a quarantined attachment:
Quarantined attachments are not moved anywhere - they are still attached to the original email, with the new extension. When you double-click on the attachment, ZoneAlarm will verify whether or not you would like to open the attachment. You can choose to open the attachment, delete it, or to check further on the validity of the email and the attachment. Since most recent viruses and worms have spread via email attachments, it is very important to protect against them."
More in MailSafe and How It Works