[Exim] Exim 3.35 system wide filter drops local part

Hi,

I've recently switched to Exim 3.35 and am having some problems with
system wide filtering.

Essentially, I'm trying to filter mail with a particular header into
a sepearate Maildir folder for Courier IMAP. That particular
header is 'X-Spam-Status' as added by SpamAssassin.

I've googled for some time, checked FAQs, etc but am yet to find a
solution to this problem:

My Exim system wide filter is as follows:

    # Exim filter
    if $h_X-Spam-Status: contains Yes
    then
        save Maildir/.Spam/
    endif

What this is does is save mail that matches the filter to:

    /var/spool/mail/message filter@???/Maildir/.Spam/new/...

Irrespective of whatever the original local-part was. The relevant
parts of my exim.conf are as follows:

# global
message_filter = /etc/exim/system-filter
message_filter_directory_transport = custom_delivery

# transports
spamcheck:
driver = pipe
command = /usr/sbin/exim -oMr spam-scanned -bS
transport_filter = /usr/bin/spamc -u ${local_part}
bsmtp = all
home_directory = "/var/tmp"
current_directory = "/var/tmp"
user = mail
group = mail
return_path_add = false
log_output = true
return_fail_output = true
prefix =
suffix =

custom_delivery:
driver = appendfile
envelope_to_add
create_directory = true
no_from_hack
prefix = ""
suffix = ""
user = mail
group = mail
directory_mode = 0755
return_path_add = true
directory = /var/spool/mail/${local_part}@${domain}/Maildir
maildir_format

# directors
spamcheck_director:
driver = smartuser
transport = spamcheck
no_verify
condition = "${if and { {!def:h_X-Spam-Flag:} ... "

custom_user:
driver = aliasfile
search_type = ldap
query = "ldap://localhost:389/o=base?uid?sub?(mail=${local_part}@${domain})"
user = mail
group = mail
transport = custom_delivery

Looking at the contents of the message it has:

    Envelope-to: message filter
    ...
    Received: from mail by hostname with spam-scanned (Exim 3.35 #1
    (Debian)) id 1AzFik-00016X-00 for <test@???>;
    Sat, 06 Mar 2004 00:50:35 +1100
    ...
    X-Envelope-To: test@???

It seems to be that there may be some problem with the submission of mail
back to Exim from the 'spamcheck' transport. Does anyone have any
suggestions on what I'm doing wrong or where the envelope recipient
address is being lost?

Thanks.