[Dovecot] Sieve during read or login?

[Rick Romero]

I was wondering if anyone thought of applying filters to email post  
delivery, pre-read.

Basically the idea would be to head off Spam, Malware or Phishing for  
already delivered email.  Malware would probably be the least likely  
target, as (knock on wood) user workstations would be updated, but a  
targeted phishing scam would not create a public signature that would  
be downloaded, yet an admin may have a regex that could be used to  
remove that email before it left the server.

I used to run find and grep on my Maildirs, but that's no longer  
practical.  I think maybe an 'on connect', or 'on read' might be an  
option.

Thoughts?

Rick