Do you want this done at the MTA [1] or MDA [2] layer ? Do you want it done for all accounts on this server, or just specific ones?
Doing this in the MTA (eg, Postfix) would tend to catch all inbound, outbound, and relayed mail. Doing it in the MDA (eg, procmail) would catch just mail delivered to accounts on this system.
Really in this scenario either or would actually work. This server's postfix instance is firewalled and only accepts connections from a main mta that has a transport relay for one user to this box.
Looking at procmail, it would seem its ideal for this. Thanks for that lead! jlc