The problem with most howto's and guide floating around the Net, is that many of them are outdated. And they hardly ever explain how it all works.
If Mailscanner is scanning incoming mails, it has to do it just after the mail was received and before it is being delivered to the mailbox or imap file of the user.
Procmail, that does some simple scanning of incoming mails. hooks itself in an existing email flow by using an Unix pipe command in a "~/.forward" file.
Another method could be that Mailscanner monitors the incoming email ports and calls sendmail to handle it and does whatever to scan it before delivery to the user mailbox.
I cannot guarantee it, but I may have time to create a similar setup with postfix during the weekend. Will let you know
