In response to Iain Gray:
> I have a suspicion that the spammer is just faking the Reply-to and From
> headers. Is this right?
Yes. We see it all the time.
> And if so how do we stop this?
You don't. 8-((
You could try complaining to all the intermediate ISPs but this is a
network abuse issue and nothing to do with Exim. If you contact me
privately I may be able to comment more on the abuse issue.