No, there is no item named Unknown003106A4.data. In some cases, there may be an attachment named "Purchase Order.rar", but not all MIME attachments are named.
The problem with eductating the user is that they don't know which message is infected, so don't know which to delete. I try to tell them to change their settings to at least not sync their Trash folder, else they could "delete" a message and still get warnings from SEP, but that's an "advanced" option.
SEP takes various actions (clean, quarantine) but it doesn't matter what it does - as I say, the infected file is restored from the server by Thunderbird, and thus reappears in the next scan. Part of our problem is that the SEP management console logs blow up, finding the same virus every day for months. We do have some antivirus on incoming mail, but even the best AV will not find zero-days, while SEP will find them a few days later on the client.
While on the server the folders are split into multiple files for faster access, when Thunderbird syncs folders with IMAP it seems to create a single Unix-style mailbox file, together with an MSF index file. In the examples above, this Unix file is called "INBOX" and contains 477 messages; for some users, many more (50,000)