It's not at all clear from the documentation nor is it logically located in the object model, but when you get a SharePoint attachment event (like ItemAttachmentAdding, ItemAttachmentAdded, ItemAttachmentDeleting, ItemAttachmentDeleted) you get the properties.Attachment collection, but the affected attachment is indicated by the properties.AfterUrl property which gives a web.Url relative url to the attachment being evented on.