For the first plugin:
To check for attachments for an email you will need to create a plugin which executes on create of the ActivityMimeAttachment entity, which is the entity which stores email attachments.
When an inbound email is processed by the Email Router (or tracked in the Outlook Client) the parent Email record is created first, and then an ActivityMimeAttachment record is created for each attachment.
If you try to check for attachments when an Email is created it will be executing before any attachments are created. However, you may also need a plugin to execute when an Email is created to set the 'Has Attachments' field to false.
The plugin on ActivityMimeAttachment will need to get the parent email activity and set the 'Has Attachments' field to true. This will handle both inbound and outbound emails.
Also note that for 100% accuracy you may need to consider the scenario of a user who is writing an email and adds an attachment, and then deletes it. This could be handled by a plugin running when attachments are deleted, but that logic can get complex (what if two attachments were added but only one was deleted?)
There is some useful sample code for dealing with the ActivityMimeAttachment entity here.
For the second plugin:
A plugin which executes on update of an email would then need to validate the following criteria:
- The email direction is outbound (a user has answered an email, e.g. sent a reply)
- The email status reason is Sent (the email has actually been delivered and is not saved as a draft)
- The email sender and/or owner and/or created by is a real user (filter out automatic and workflow sent emails)
- The regarding object is an incident
Then you can implement the required custom validation and logic.
The second item could potentially be achieved using a standard workflow, depending on how complex the custom logic is. If the logic is too complex for a standard workflow, a custom workflow activity might also be useful since additional logic or validation could be added without writing additional code.