edit admin/sendemaillib.php, look for the following code from line #723 to line #732:

if (!TEST) {
if ($hash != 'forwarded' || !sizeof($forwardedby)) {
$fromname = $cached[$messageid]["fromname"];
$fromemail = $cached[$messageid]["fromemail"];
$subject = $cached[$messageid]["subject"];
} else {
$fromname = '';
$fromemail = $forwardedby['email'];
$subject = $GLOBALS['strFwd'].': '.$cached[$messageid]["subject"];

}

DIRECTLY AFTER this code (on line #733) paste the following:

// Funky Penguin Mod starts - variable substitution in the subject
if (is_array($user_att_values)) {
foreach ($user_att_values as $att_name => $att_value) {
if (eregi("\[".$att_name."\]",$subject,$regs)) {
$subject = eregi_replace("\[".$att_name."\]",$att_value,$subject);
}
}
}
// Funky Penguin Mod ends