[Exim] header_received question

I did a search through the archive and faq and didnt find an answer to this
so here goes.

I have a system_filter that I use for basic spam checks. If a message is
tagged as 'spam' I want to parse out the host that SENT the spam to us (i.e.
the first host to connect to our email system).

A typical email will have a received section like:

from out3.email.blah.net ([xxx.xxx.xxx.xxx.xxx])
        by bob.somewhere.com with esmtp (Exim 4.01)
        id 16kTxP-0003oB-00
        for bob@???; Mon, 11 Mar 2002 11:51:35 -0600
from [xxx.xxx.xxx.xxx.xxx] (helo=cspool.email.blah.net)
        by out3.email.blah.net with esmtp
        id 16kTuV-0006QK-00
        for bob@???; Mon, 11 Mar 2002 17:48:35 +0000
from [xxx.xxx.xxx.xxx.xxx] (helo=smtpin1.email.blah.net)
        by cspool.email.blah.net with esmtp (Exim 3.33 #1)
        id 16kTuL-0001a6-00
        for bob@???; Mon, 11 Mar 2002 17:48:25 +0000
from [BAD.BAD.BAD.BAD] (helo=some.dumb.relay.com)
        by smtpin1.email.blah.net with smtp
        id 16kTuO-0005Pq-00
        for bob@???; Mon, 11 Mar 2002 17:48:28 +0000
from [xxx.xxx.xxx.xxx] (helo=originating.spammer.com)
        by some.dump.relay.com with smtp
        id 16kTuO-0005Pq-00
        for bob@???; Mon, 11 Mar 2002 17:48:28 +0000

Here is my problem. I want to grab the 'BAD.BAD.BAD.BAD' ip address. As you
can see this IP will never be the same (or at least nothing I can guess) nor
will it always be after a specific host other than *.email.blah.net.

I just want to build a list of spamming hosts and build some spam notices
based on high hitting open-relay/spam sites.

--
Mike Wilson            NTT/VERIO ISS Group
mwilson@???        http://www.verio.net/