I used to work in a small office which provided basic desktop support for users. 

One day I had to answer a call from a very angry customer and he asked for my boss. He wanted to know how could one email slip through their spam filter/network-based antivirus software (if there is such a thing, that's what he claimed), and the attachment got filtered/caught by the antivirus software on his desktop.

Till I could reach my boss I had to tell him that a spam filter is not flawless/perfect and sometimes one email mange to pass. 

Also to support my claims, I explained to him Gmail themselves allowed that email to attachment despite that his antivirus software had detected and removed it.

Was my explanation right? How would a security expert deal with this situation?

Your answer is pretty OK, but you could explain the ongoing "game" between spammers and spamfilters a bit more. This makes it understandable why some spam always will find its way to the customer. 

Spam filters try to catch all mail that is spam.

Spammers try to create mails that are trusted not to be spam - both by spam filters and by humans.

For spammers, this comes down to creating mails that...


can pass spam filters;
when arrived in the inbox look like legit email so the user opens it;
and then is interesting enough so users click on the link inside to buy something or have malware installed.


Spammers buy spam filters, and test their new spam tactics to see if their mail passes the filter. If the mail passes, they are one step ahead. Then they go out in the wild, send out millions of mails, effectively showing their new tactic. The spam-filter makers notice, and they update their filter. This is an ongoing game. It's similar in the virus industry. 

When you see spam that has no links or attachments, it is probably spam to poison filters, to confuse filters, to make it easier to fool them later on.  
