It is possible to hide extra files in a zip file that are not referenced in the directory. These may be missed by standard extraction, but it should be possible to find them (and perhaps flag them as suspicious).
https://www.codeproject.com/Articles/13808/Steganography-16-Hiding-additional-files-in-a-ZIP