I don't think John should do this because he doesn't know if it's a spammer using his friend's name. He doesn't know for sure if the medicine really works, and maybe the file attachment is a virus. You should not open files if you do not know what is inside.