That person also needs to be able to call for back up. Your incident response team needs to be in place, read to roll into action with well-scripted roles, whenever the call comes. Training runs and practice drills can help to prepare for this. The last and best line of defense against malicious code is the well-informed computer user. They need to understand why this rule was made, and how bad the consequences can be if it is not followed.
Awareness is cheap and relatively easy.
Print posters, send out flyers, make announcements at staff meetings. Awareness builds on top of training. Make sure that all employees who have access to email have been trained to use it properly, that is, in accordance with company policy. All employees who have access to email need to be are aware of the damage that malicious code can do to systems and data and know what precautions they should be taking and why. Whenever possible, give them this information before they start using email, or make them take a test to prove they get the point and so qualify to use this valuable resource.