Mixed File Types?

We're using version 3.0. Is it true that the file signature verification (SignatureFilter = "known") and file name filter (FileMask = "*.JPG;*.JPEG;*.GIF;*.PNG) are separate filters? That is, the file signature test is done first, and then, separately, the file mask test is done?

We've seen a case where a BMP file which was renamed to have a .JPG suffix was uploadable, even through one would not expect it to be. Is it possible to add a test where the file name extension is used to guide the signature test, to make sure the file is what it claims to be?

Thanks.