How do I report a potential threat that was not picked up by Sophos?

Apparently I bought a ticket via American Airlines to go to Indianapolis for $437.27.   There is a zip fiile attached which is 320kb in size.  I looked up the originting ip which is Poland; the flight number given is incorrect.  I am pretty certain that the zip file contains malware, but it has not been picked up by my Sophos Anti virus   Threat detection engine: 3.28.1
Threat data: 4.74
Release date: 6 February 2012
Protects against 3318230 threats.

I need somewhere to send the e-mail so you can investigate it.  Please advise

Alan