[phpnode]

opening the .rtf as text indicates the former, unless he's a super, super genius who can hide exploit code in plain sight.