Scanning on the ESA has a global limit on large messages. If a message is too large, it is generally exempt from many scans, and sent to the end recipient(s).
To change the message-scan limit from the CLI, use scanconfig. You will need to make adjustments to the "maximum size of attachment to scan" options as highlighted.
Note: Remember that the larger the scan size is set, the more appliance overhead and resources are used.
There are currently 5 attachment type mappings configured to be SKIPPED.
Choose the operation you want to perform: - NEW - Add a new entry. - DELETE - Remove an entry. - SETUP - Configure scanning behavior. - IMPORT - Load mappings from a file. - EXPORT - Save mappings to a file. - PRINT - Display the list. - CLEAR - Remove all entries. - SMIME - Configure S/MIME unpacking. > setup
1. Scan only attachments with MIME types or fingerprints in the list. 2. Skip attachments with MIME types or fingerprints in the list. Choose one: >
Enter the maximum depth of attachment recursion to scan: >
Enter the maximum size of attachment to scan: >
Do you want to scan attachment metadata? [Y]>
Enter the attachment scanning timeout (in seconds): >
If a message has attachments that were not scanned for any reason (e.g. because of size, depth limits, or scanning timeout), assume the attachment matches the search pattern? [N]>
In case of a content or message filter error, should all filters be bypassed? [Y]>
If a message could not be deconstructed into its component parts in order to remove specified attachments, the system should: 1. Deliver 2. Bounce 3. Drop >
Configure encoding to use when none is specified for plain body text or anything with MIME type plain/text or plain/html. 1. US-ASCII 2. Unicode (UTF-8) 3. Unicode (UTF-16) 4. Western European/Latin-1 (ISO 8859-1) 5. Western European/Latin-1 (Windows CP1252) 6. Traditional Chinese (Big 5) 7. Simplified Chinese (GB 2312) 8. Simplified Chinese (HZ GB 2312) 9. Korean (ISO 2022-KR) 10. Korean (KS-C-5601/EUC-KR) 11. Japanese (Shift-JIS (X0123)) 12. Japanese (ISO-2022-JP) 13. Japanese (EUC) 
If you make any changes and adjustments to the settings, be sure to commit all changes from the main CLI prompt.
In many cases, you will find that the particular message may have exceeded scanning, but did process and deliver as originally expected. You will need to research and reivew your mail logs for the final disposition of the original MID.