Need way more details before anyone can provide a solution here - at least anything more than just hints.
For one, uploads require a file name. How are you planning to determine file names for the uploaded messages?
What about format? Do you need to save the email as PDF? or some other format?
Do you need to associate uploaded files with their corresponding email? How do you plan to do that? (hint: if you don't you'll end up with a bucket full of files with little (or no) obvious way to know which message they relate to)
How do you plan to deal with namespace conflicts (e.g. two attachments of the same name)
The security element is irrelevant - that's up to your FTP server and nothing to do with the upload process.
Before you go too much further, though, I recommend you consider your reason for this. Why are you doing this? Is it just to make the messages (and attachments) available to a group of people? if that's the case why not just create a shared IMAP account on the mail server? that way everyone can see incoming messages, and they're searchable via everyone's (familiar) email client of choice. It also requires almost zero setup and maintenance.