[exim] trusted users and web generated mail

I have a new client who uses php to generate email messages,
and they invariably dispatch with an envelope From of "nobody"
(the apache user). Consequently when he gets bounces back they
get bounced to "nobody@???" and not him.

My support email is flooding with his numerous bounces from
his mailing list php software.

I had him place an "Errors-To:" header in his email however
most bounces from other networks are at smtp verification time,
and probably do not "see" the Errors-To header.

Can someone advise how to deal with this client getting his
own bounces, while NOT making him a trusted user?

Thanks