[exim] How to configure exim deliver to a local address via …

I have an smtp server (S1) which relays incoming mail on port 25 to exim on
the same box on another port behind a firewall. S1 rewrites, among other
things the envelope-from as SPFLocalpart@???

Bounces to SPFLocalpart@??? are handled by (S1), but if
example.com rejects the message in session but _after_ the DATA phase, then
Exim accepts the message from S1 and attempts to deliver a bounce message to
bounce.myhost.com. This fails with the 'lowest numbered MX record points to
local host' error or similar error if bounce.myhost.com is defined as a
hubbed_host.

I want this bounce to be handled by S1 which will rewrite the RCPT-TO
(SPFLocalpart@???) as the original sender (and relay it to Exim
for forwarding).

Maybe I can get around it by assigning an alternate ip to bounce.myhost.com.
Or just doing the forwarding within Exim.

But my questions is, is it possible to force exim to route this bounce via
SMTP even though the address is local?