One option I have used before is to define your own delivery wrapper (I use maildrop for actual delivery - but this should work with any) then you can just do your stuff there. Something like this in master.cf
:
maildrop unix - n n - - pipe
flags=Rhu user=vmail:vmail argv=/usr/bin/maildrop-wrapper
-d ${user}@${nexthop} -f ${sender} -A X-Delivery:maildrop
In maildrop-wrapper, do your stuff then just call the real maildrop:
#!/bin/bash
#do your stuff
#and/or:
exec /usr/bin/maildrop $@
You can run it before or after calling maildrop, important note: the script will receive the email via stdin, so you will have to buffer it if you intend to pass it to maildrop later (which the example above does not do). I would probably recommend using perl for this as there are more mail handling libraries there than in bare shell.
Edit: If you only want to do this for a single user then this is overkill, have a look at maildrop - in particular the section about "external commands" via backticks. Define a maildroprc for this user with the rules required.