CPYTOSTMF authority question

I have found in tracing audit log problems, that we have been leaving
behind stream files that become email attachments....
CPYTOSTMF FROMMBR('/qsys.lib/qtemp.lib/mimeout.file/m+
imeout.mbr') TOSTMF(&STFILE) +
STMFOPT(*REPLACE) STMFCODPAG(*PCASCII)

this creates the stream file with the authority of DATA(*RWX) NO OBJECT
AUTHORTIES
for the user that ran the job.... we then perform a CHGAUT OBJ(&STFILE)
USER(*PUBLIC) DTAAUT(*RWX) OBJAUT(*ALL) and then pass that stream file
onto MMAIL....

but at the bottom of the program, when we try to RMVLNK, it fails on
CPFA09C, not authorized...

I don't know for sure why we do the CHGAUT, but my guess was it allowed the
mmail command to process...

1) would a different value than "DFT on the AUT parm of the CPYTOSTMF
command fix this?
2) the original MIMEOUT file's authority a problem?