The easiest is probably going to be to have a robot FileMaker client machine sitting next to the server to do these things.
Insert From URL is supported via the server and you can use that to insert files. However you may need to execute a batch file script to place the file in an accessible location, like the filemaker server documents folder.
So this means the message or attachment must be exported from the mail table, and imported in the document table. Therefore an "Export File" and "Import File" script step are necessary.
This really isn't true, there are a number of methods that get around an export/import need. For example, copy and paste are both supported in filemaker script steps, as is set variable, and things like Base64Encode()/decode.
But if you're going through all the trouble of linking up a "messages" table, why not just leave it in that table, and restrict access or manage it as needed?
I'd been thinking about this possibility, and the fact that you give this advice is for me the confirmation. Additional advantage is that I already have a bunge of client-scripts written, that I can resuse, so the time to implement this will be quick. Thanks for your advice.