[Exim] finding administrative prohibition

I've got a friend who tried to send me an email with a map, and got a bounce
with a generic 'administrative prohibition' message. A plain text message goes
through fine.

In my reject log, I get a simple msg:

2004-06-02 11:00:21 H=sccrmhc12.comcast.net [204.127.202.56]:54839
F=<XXX@???> rejected RCPT <YYY@???>

In the main log (with 'log_selector = +all'):

2004-06-02 11:00:21 H=sccrmhc12.comcast.net [204.127.202.56]:54839
F=<XXX@???> rejected RCPT <YYY@???>

2004-06-02 11:00:21 H=sccrmhc12.comcast.net [204.127.202.56]:54839 incomplete
transaction(RSET) from <XXX@???>

2004-06-02 11:00:22 SMTP connection from sccrmhc12.comcast.net
[204.127.202.56]:54839 closed by QUIT


All my reject/deny messages in my exim.conf contain specific log messages, as
do all tests in the system filter. What else can I do to figure out where this
generic message is coming from, and add a detailed message?