You should ensure you are running a fairly recent version of MailScanner and the front-end. Change the following settings in the MailWatch configuration and then click Change:
1. WHM > MailScanner > Front-End Settings > Advanced Settings (click the link) > Enable email storing in quarantine > yes
2. WHM > MailScanner > MailScanner Configuration > Non Spam Actions = store deliver
IMPORTANT: You MUST include "deliver" in the Non Spam Actions setting or all email identified as non-spam (i.e., all valid email) will be discarded and not delivered at all.
3. WHM > MailScanner > MailScanner Configuration > Quarantine Whole Messages As Queue Files = no
From that point on any messages coming in will have a copy stored in quarantine and will have additional options at the bottom for Release (not available if it contained a virus or other infection, but will be available for non-infected blocked attachments), Delete, and SA Learn. The emails will still be delivered to the recipient (unless they are blocked or deleted for some other reason), but a copy will be stored in quarantine for the length of time set for $days_to_keep in /etc/cron.daily/clean.quarantine.cron.
