Step 1: Don't Panic
I don't think you're hosed at all. The "attachments" directory is purely a temporary store for uploaded files.
A user starts a 'compose' session.
User decides to attach a file.
User browsers their local file system for the file.
User "Add"s the file, which goes to the "attachment" directory.
User does some more typing and add some ":-)".
User presses the "Send" button.
When the user presses the send button the attachment is mime'd into the message itself, after the body content. After this is accomplished a SquirrelMail process should delete the attachment from the temporary store. If something crashes in the process (unsure of what conditions can actually cause this) attachments can be abandoned in the temp store.
If you're using IMAP the users can leave their mesages in the INBOX (which in sendmail/postfix + UW-IMAP) will be located in the /var/spool/mail/<username> file. When a user moves the file (either by deleting it or moving it to an IMAP folder) it will go to a local file in the user's home directory.
In short: Squirrelmail's 'attachment' directory is only ever touched by userland while uploading an attachment. That is the last time any user will touch that file.
You may want to investigate the mime issues a little further. 'httpd -l' lists the modules built into your httpd binary. Make sure you're loading the proper modules and that you have your mime.types in order and your php type statements (in your httpd.conf) setup as per the SquirrelMail installation directives.