[Exim] sender verify calls out to the wrong host

This happened about 3 months ago and I should have pursued it at the time.
Thanks to my procrastination I no longer have the "configure" file in
question. But my setup was pretty straightforward...

I was running exim 4.04 on two boxes, one primary MX for the domain, one
backup. In certain [irreproducible] situations the primary box would do a
verify=sender/callout to the wrong machine. Specifically a random host
would be sending me a message but my primary box would callout to my backup
mx machine. I found log entries for at least two occasions where this
happened. Here's one such entry...

2002-07-19 13:19:44 H=motherfish.xiph.org [216.27.191.133] sender verify
fail for <owner-vorbis-dev@???>: response to "RCPT
TO:<owner-vorbis-dev@???>" from yoda.egwpartners.com [66.31.42.79] was
550 Han requires authentication

Han is my primary, yoda is my backup. The response given by yoda is correct
(for that situation). But why was han calling it? Looking through bits and
pieces of the code I came up with one unsubstantiated theory: I have yoda
listed as a "fallback_host" on han's smtp transport. So if acl_verify()
calls verify_address(), which calls route_address(), which builds the
associated host list for the address, would the fallback hosts get tacked on
to that list? And is there any type of failure that could occur during a
callout that would cause exim to start walking down that list of hosts and
end up talking to a fallback host?

I've since upgraded both boxes to exim 4.10. But the problem appeared so
rarely & randomly that I can't be certain the upgrade corrected it. Any
thoughts? Does that theory make any sense?

Thanks.
--
Rick Ennis