We publish release notes in Confluence and attach software releases directly into the page. Sometimes a page ends up containing multiple versions of the software but only the latest release is being referenced (because developers forgot to delete the old attachments). There should be a way to detect "orphaned" attachments that are not referenced by any page across all of Confluence similar to how we can detect "orphaned" pages. I acknowledge the fact that some attachments may be accessed by external websites (and so shouldn't be removed) but in our case this is not the case and I suspect in most cases attachments that are not referenced on Confluence really are orphans. List these out for users and they will pick and choose which ones to delete.
Retention rules were shipped as part of the Confluence Data Center 7.16 release. These allow you to set retention rules to specify how long to keep historical versions of attachments. You tell Confluence how much historical data you want to keep (by number or age of the versions), and then a scheduled job will delete the excess, in small batches, so as not to impact your site's performance. While this doesn't specifically help to identify and detect unused attachments (attachments that aren't referenced by other pages in the instance), it does help you manage attachments that are no longer utilised in your instance.
You can learn more about using retention rules to delete unwanted data by reading our documentation. You can also learn about identifying particularly large attachments in a space by following the guidance in this documentation.
Please upgrade to the Confluence Data Center 7.16+ to access retention rules.