Thanks, y'all, for the help. Turns out this ACL works just fine for
what I wanted:
deny message = The original message did not come from this site.
condition = ${if eq{$sender_address}{}{yes}{no}}
condition = ${if eq{$local_part}{brian}{no}{yes}}
log_message = Refused a bounce message
I had forgotten to HUP the server. I got this confused with SA-Exim,
which checks its config file and reloads it automatically if it's
changed; my misconception was backed up by the fact that 'exim -bh' saw
the changes to my config file (of course, as it was a new instance of
exim), so I mistakenly thought the server had automatically reloaded
it. After I HUPed the exim process, everything worked fine.
Thank you again for helping!