Type of file isn't checked when uploading. They are stored in folder that isn't directly accessible from the internet. Files don't have permissions to execute. Then user may query some url, and files will be returned with Content-Disposition: attachment
Scanning before delivering the attachment is just the courteous thing to do, but there are lots of things that are problematic to store but which will pass a virus scan just fine.
This may be a tad paranoid, but if you wouldn't intentionally write software that lets people plant evidence that incriminates you, don't unintentionally write software that does that.
What kind of information do you log about the uploaders? Might you have enemies who would upload child pornography or bomb-making plans to your server and then send an anonymous tip to the police?
Type of file isn't checked when uploading. Its content is parsed with some HTML/XML/JSON/etc. parser. After parsing the file isn't stored at server.
Anti-virus scanners are unlikely to be helpful here. Same question as above. Can you sanity check the information you extract from the files or prove that whatever information you store came from an external source?