Opening an attachment can't do anything more than you could do intentionally. If some low-level nobody really has the ability to bring down the NHS systems (no matter if it's done by accident or with malicious intent), then I can point to a long list of managers and security officers in NHS that definitely need to be fired for allowing a system where this is possible.