Not sure of utility of such feature, but I had it on top of my head for a while.
If configured via own per user API key, offer button to scan attachments / urls against VirusTotal database. This would have to be handled in JS though.
Why do this client-side? Wouldn't server-side scanning make more sense? We could express the results by inspecting a header on the email.
A VirusTotal milter adding a header could do the trick indeed.
You cannot do this server side sadly. VirusTotal does not offer such service. However, individuals can use their API.
Don't re-download the file for virustotal + opening attachment. Browser caching would probably work. Mega.nz-style 'download to browser storage, then download from localhost' would probably always work, yet it might need additional browser permissions, and is overall unclean.