I believe the sound should be used for heuristic - when a suspicious (but not clearly infected) message is received/sent.