If this is sendmail you should be able to do a Milter to do this without trying to race queues. or even easier is to make the sendmail listener on 25 a no deliver and use the queue mover script included in contrib to move queue files from the no deliver queue to an active deliver queue (testing them for your bad messages at that time). Any questions let me know.

Edited:
I don't know that I got my point across, most MTA's use queues as very transient stores for files, unless you force the queuing system to hold a file and then force deliverability after you are some scanning the file you are in a race with the MTA. This means you may pass the messages without scanning at all, clobber messages that are being created or delivered or cause an issue with the MTA if you have the file opened while it is trying to delete. Almost all mailing systems (sendmail, qmail,exim etc) have ways to create an accepting queue that listens on port 25 and queues incoming messages, but then holds them in a queue without delivering. You than can check the lock stat of the mail message act on it and then move it to a queue that _is_ actively delivered. For an example of moving sendmail messages between such queues check out re-mqueue.pl in the contrib dir of the source tarball. other MTA's are a bit different but the same general idea works. You will save yourself a lot of headaches doing this the right way instead of just scanning live transient files. My .02...

-Waswas