[Exim] Exim 3.36 - how to verify with 2nd router/director

Okay, here's a tricky one. Exim 3.36 on RHLinux 8.0 (with SpamAssassin 2.55
just in case you care).

The first director _and_ the first router each deliver messages via
SpamAssassin, which turns around and re-submits them. A condition prevents
this router and this director from being re-executed, so the following
routers and directors are used. Thanks to Derrick 'dman' Hudson for sorting
this out and explaining it in short words for my benefit.

Now, the first router and first director are marked 'no_verify', because
they can't verify. That works, but...recipient addresses are verified and
invalid addresses are failed before the first director or router is invoked.

How can I get any old address to be accepted so that the first director or
router is invoked? Then, after SpamAssassin has done its thing, we can worry
about the validity of the address. That way, my system filter will see the
re-submitted message, note that it's tagged as spam, and freeze it. Thus, I
won't waste cycles and bandwidth trying to send a NDR to a spammer. That'll
deal neatly with 'wronguser@???' addresses as well as
'olduser@???' addresses.

I've been over and over the book, and although I'm wiser than I was, that's
not difficult when you're starting from scratch. Any ideas on how to do
this? A catchall, fail-everything director and router at the end of their
respective lists? A clever director/router option I've missed?