Phishing mails will use any pretext to try and persuade you to open a malicious attachment. From that perspective, the appearance of a mail pretending to be a Salesforce.com approval request should not have surprised me.
I don’t use Salesforce.com, it doesn’t send approval requests as ZIP files, and I’m never going to be allowed to file for $8073.64 in expenses. This is a highly unsubtle phish that would be easily caught by any decent mail filtering system — but I suspect it will catch someone out at some point.