Exactly. Never trust an extension (or MIME type for that matter).
A Windows WMA file can contain active content (like javascript for instance). A true MP3 cannot. But you can rename a WMA file to MP3 and Windows mediaplayer will happily play it, including it's active content.
If you're looking for a content scanner you always need to make sure it doesn't only look at the extension or MIME type, both can be faked or changed easily. A proper content scanner will analyze the file to see what it really is and block or allow it based on that.