Your slightly wrong. Magma uses mmap'ed temp files to hold the messages because ClamAV requires a file handle, or a file name. In theory the message only ever hits disk if memory is exhausted. And at least in theory, is never linked to the file system tree where it can be intercepted. If you know a better way, please submit a pull request.