@paul out of curiosity, why not delete the attachment altogether after the email is sent?

Is there value in keeping them for forensics?