[Exim] System Filter - $1 passed to mail file?

We have a requirement to hold mail messages that contain "suspect" attachments and advise the local user (be they sender or recipient) that that mail is held so they can have it released if it is work related. I have a system filter with snippets like the following (thanks Nigel):

if $header_content-type: matches "(?:file)?name=(\\\\S+\\\\.(?:avi|mov|mpg|mpeg|wmv))"
then
mail to $header_to: from xxxxx@??? subject "Held message $message_id" expand file /usr/lib/exim/scripts/heldmessage.txt
save /var/spool/httpd/htdocs/suspectmail/held/$message_id 644
freeze
seen finish
endif

I would like to be able to use the attachment name in the included file, but it doesn't seem to be possible when used in the mail command. Am I right there? IF so, how can I get the included file to include the attachment name? It expands the $reply_address and $message_headers no problem.

Cheers
Kevin