Antivirus engines scan emails for malware by analyzing the content and attachments for known threats. They use signature-based detection to identify known malware and heuristic analysis to detect new or unknown threats. When a threat is detected, the antivirus engine can quarantine or delete the infected email, preventing it from reaching the recipient.