[exim] Replacing header to with envelope to

Hi

I have a router called billing_aliases which does a lsearch in a
billing-aliases file. Its setup like a regular system aliases router.
This file has aliases addresses like:

customer1234: foo@???, baz@???, billing-archives@???

This works but the header To: address is customer1234@???. I
would like this to be rewritten to be foo@??? baz@??? etc as
appropriate, ie I wish to replace the header to with the envelope to.

I have been trying to do this by using headers_remove and headers_add
within the router. I don't seem to be able to make it work because I
can't find a variable that contains the envelope to address, I thought
$received_for might work but it doesn't seem to.

Can someone suggest how I may get this to work. Is header rewriting the
correct approach or should I be looking at doing it via the REWRITE
CONFIGURATION that somehow looks at the billing alias file?

Thanks
--
Donovan Jones