I have observed that the Attachment created automatically by workflow and OB message scenarion.. has the created by user as the user to send field in the OB setting. but it is totally wrong as it can be generated by any user. Does this have a workaround ?
When you use outbound messaging, the document package runs as the user selected in send field and that is why the attachment is created by that user. If this is a user triggered document package then I would recommend the having the user run it via a button. How do the users currently trigger the outbound message?