[Exim] rejecting mail for user on a given domain

Hello. I have exim answering mail for two domains on a server (say
foo.com and foo.org). I have a user for whom I want to reject mail on
one domain and accept it on another. In other words everthing for
user@??? should be rejected and everything for user@??? should
be allowed.

I've tried a system filter matching on all the headers I can think of
that calls 'fail' when it sees user@??? but still some mail gets
through for that user. (spam without his address in any of the
headers.) The only place I see his address in the headers is in the
Envelope-to: which doesn't seem to work for filters.

Any help is greatly appreciated.

^Roman