[Exim] variation on dns blacklists

My Exim 4.20 receives mail for a user whose mail is forwarded from another
service with a constant ip address (1st 3 octets), thereby negating my
normal dns blacklist spam blocking measures. However, the ip address which
sent the message to the forwarding service is within the headers. I'm
wondering if/how I can extract that ip address and use it to check against
dns blacklists.
Don Walker