Nate,
Thanks very much for the explanation.
One way to help users when faced with these kinds of "on the one hand, but on the other hand" results, would be to provide additional details on what the nature of the possible threat is (that is, why NPE thinks it's bad; or maybe a description of what it thinks the bad file does). To minimize the size of the NPE program, this information could be made available online via a link right on the program screen ("Click here for more information about this threat").
Hope this helps.