Probably one of the (relatively) easier methods to do this would be to set up a Mail Proxy, and in the spirit of not reinventing wheels, I'll point you to the same node I based my own Email Proxy/Filter on, McD's A SpamAssassin-Enabled POP3 Proxy, Just look for the sub scan_mail, and replace it with one of your own liking. As an example of another plugin filter for McD's proxy, allow me to direct you to my own code to Convert Multipart Email to plain text ((shameless plug)).

Oh yes, and as further food for thought, a related column (for SysAdmin magazine) by merlyn