[exim] Some mail seems to bypass sender verification acl

I recently set up an acl on exim 4.30 to do sender verification on
senders from our email domains using the same tables I do recipient
verification against.

acl_smtp_mail = check_sender

check_sender:
  deny   message = bad sender
         condition =
${lookup{${domain:${sender_address}}}lsearch{/usr/exim/verify_domains}{y
es}{no}}
         condition =
${lookup{${lc:${sender_address}}}dbm{/usr/exim/exch-user-table.db}{no}{y
es}}
  accept

This blocks most mail I was expecting it to but a few unknown senders
seem to get through each day. If I run exim -bh with the same sender
address that got through it is failed by the acl.

Is there a way that some mail can avoid this acl?

Thanks,

Brandon