I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale is that if their system is infected with malware, the malware might try to use email to perform an undesired function, and the real-time email scanner might catch it.
I've recently been asked by someone who only uses webmail and does not use any email applications if they should run a real-time email scanner. They use Windows 7 SP1 and use a real-time file system and web traffic scanner (I'll leave out the brand because I don't want to sound like I'm plugging products.)
I have been thinking about the correct recommendation to make, but I want to pose the question to this forum before responding to him. Is there any reason for him to have a real-time email scanner installed?