How to validate temporary files with form API
This isn't a particularly clever solution, but hopefully it's ok. As far as I could tell you can't validate temporary files, they have to be uploaded. 

So I ended up uploading them to the private directory and then immediately deleting them. Because some of the data might be sensitive I don't want to store them and this form takes place on a secure page.

function mymodule_form($form, &amp;$form_state) {

   $form['file1'] = array(
     '#type' =&gt; 'file',
     '#title' =&gt; t('File1'),
   );

   $form['file2'] = array(
     '#type' =&gt; 'file',
     '#title' =&gt; t('File2'),
   );


}


Now for the important bit.

function mymodule_form_submit ($form, &amp;$form_state) {
    //check if any file was attached
    if($_FILES['files']['tmp_name']['file1'] != '') {
      //Save and validate the file to the private file area
      $file1_included = file_save_upload('file1_included',
                                     array(
                                        'file_validate_is_image' =&gt; array(), // Validates file is really an image.
                                        'file_validate_extensions' =&gt; array('png gif jpg jpeg'), // Validate extensions.
                                      ), 'private://');
      //This is set-up for the email. Mimemail stores attachments in $params.
      $params['4'] =  array('uri'    =&gt; $file1_included-&gt;uri,
                          'filename' =&gt; $file1_included-&gt;filename,);
      //The file has been uploaded. So we'll set a variable which will be called later to delete it.
      $del_files['file1'] = $file1_included;

    }

   if($_FILES['files']['tmp_name']['file2'] != '') {
   //.... same as file 1...
   }    

  //this will send an email. Note $params. We've put all our attachment information in 
  //there.
  $message = drupal_mail('mymodule', 'notify', $email, language_default(), $params);

  //This function will delete all the files we've just uploaded. We check if
  //the variable has been set. And if it has then we call it and delete the relevant
  //files.

  if (isset($del_files)){
    _tellafriend_filedelete($del_files);
  }

}


This is the function we call to delete the files

function _mymodule_filedelete(&amp;$del_files){
   //we know the variable exists, but now we have to check which files were uploaded.
   if(array_key_exists('file1' , $del_files)) {
    //and if they were uploaded. We delete them.
    file_delete($del_files['file1']);
  }
   if(array_key_exists('file2' , $del_files)) {
    file_delete($del_files['file2']);
  }
}