How you store quarantine messages will have affect on performance depending on the number of messages. For high volume server, mysql should be far better. ANd it would greately improve if database maintenace is done, and if, for example, quarantine messages do have a time limit on how long they should be kept, let say 30 days, after which they can b eeither deleted or submited as spam, since nobody was looking for them.
As releasing messsages from quarantine is not a web email client, but administrative function, the need for the content of the message is not there. aving message in sql will simplify displaying first , lets say, 100 charactters of the message, just to give idea of message content.
Displaying sender, receipient and subject is sufficient to come to edicated decision about if message should be released or not. When yo think of it, if message is coming from unknown sender, with unexpected subject, it is probably a message that you could not care less about. Receipient is important in situation where domain admin is the only one who will release messages. When receipient A comes to them adn ask for email from sender B, they know exacly what to look for.
When it comes to releasing it is important to ad feature if sender can be automagicaly addedd to whitelist, just to prevent future events if sender is sending banned file types. Or to create a SA rule, with negative score, if content si the reason for banning. Either way there should be an interface to manage those exclusion from the rules imposed on the system wide.