A server that doesn't do anything isn't a useful server. A text file may not be executable by itself, however generally processing has to be done on it. Zero-day vulnerabilities are generally not issues with normal program functionality, but rather exploit some obscure programming error such as having functionality get hijacked when particular malformed input is sent.
In your mail server example, perhaps there is a spam filter that parses it and if you put some length of e-mail it causes a bug in the behavior of the spam filter. Or perhaps when you send it a malformed SMTP request you can get it to execute arbitrary code that you put in your malformed SMTP request. The e-mails themselves may be text but that text has to be operated on at some point. The protocols to handle the exchange of those messages also have to do more advanced executions and need to write and read information from disk.
A possible zero day vulnerability could be present in any portion of the process and since developers aren't perfect, any part of it could potentially have an issue. The only way for a computer to be perfectly secure (to the outside world) is to not have it respond to the outside world at all. If you expose any kind of interactive functionality at all then it is possible a bug in that functionality may allow arbitrary commands to be executed by feeding it input that overwrites memory with a call to code that is included with the input.
This is called a buffer overflow, and while it isn't the only type of zero day vulnerability it is a pretty common one. In memory, there isn't any difference between data and program instructions. Things called pointers tell the computer where to go to look for data or its next instruction. If you can put instructions in as data and then alter a pointer to tell the program code to run the code you put in the data portion, it will think it is following the program rather than running on data. There are some technical measures that make this a little harder to do, but that's the basic idea and there isn't really a perfect way to stop it.