i can always rename my a.exe to a.jpg, can i not?

but i guess you could try/catch opening the uploaded stream as a .NET image, and reject the file if exception is caught.