Question about filtering exim4

Hi all!
There is exim4.96 Everything works properly, no problems. Unexpectedly, the task was set: to block letters with attachments like - rar, zip, tar …, etc., in order to avoid running some encryptor by users. OK. I googled until my eyes popped and, according to poor knowledge, did the following: The .forward filter file contains:

# Exim filter                                                                                           
if $message_body contains "qqq"      # понятное дело тут будут указаны расширения архивов                                                                   
then
    deliver "blocked@_mydomain.com"                                                                       
    pipe "/home/папка/blockedmail.sh ${local_part}@${domain} ${message_id}"                         
    seen finish
endif

The script file itself:

 #!/bin/sh
echo "Your email has been blocked due to violation of our terms of service.\n[$1]\nMessage ID:[$2]\nSender...\n" \
| mail -s "You have a new mail in quarantine!" "$1"

As a result, if the letter contains the content “qqq”, it redirects this letter to the blocked_@mydomain.com mailbox and sends the necessary message to the recipient. Now I can’t understand why the filter only works with one local mailbox (eg bigchlen@mydomain.com)? If I send it to another mailbox like vaskaspizdaskas@_mydomain.com -
then the filter does not work and immediately sends it to Vasily with the content “qqq”. I understand that the problem is that hestiacp only works under one user. How to make the filter work for all users?

Perhaps there is another solution to block attachments with archives with a notification to the recipient?