Minimum permissions required for mail attachment in DbMail
As seen in the TechNet article on sp_send_dbmail:


  Execute permissions for sp_send_dbmail default to all members of the
  DatabaseMailUser database role in the msdb database. However, when the
  user sending the message does not have permission to use the profile
  for the request, sp_send_dbmail returns an error and does not send the
  message.


As for attachments, the SQL Server service account (the actual Windows/AD account that the SQL Server process runs on) is also going to need read access to the actual folder where the file is stored.