First off, I really like that you came over to the forum instead of just opening the attachments and then creating a rant post on the forum later on saying you’ve had a bad experience on Fiverr.
It is fine if the buyer sent you some files via the inbox. However, please don’t start working on any attachments the buyer sends via your inbox until they actually place an order with you. You will get a notification (and even an e-mail specifically saying you’ve received a new order from xyz buyer) if/when that happens.
The first thing I do before opening any attachment is to see the file extension. Is it an extension you recognize and does it make sense for that particular file to have that extension (be particularly weary of files that have a .exe extension as they could potentially be malicious).
The next step would be to run the file through a really good/standard, updated antivirus software. I only open the file after I’ve gone through all these steps.
No, I can’t think of any other way for the buyer to send you files when they don’t have an active order with you. If the buyer has an active order with you, they can also attach files via the order page. The only other way a buyer can attach a file (other than your inbox and the order page — in case you have an active order with them) is through a buyer request.
I hope this answers your questions.