[exim] Problem with unwanted address rewriting in exim 4.50

I'm having a problem relating to address rewriting on my Debian server
running exim 4.50. To me it looks like this is a bug in exim, but I'm
quite prepared to be told I'm missing something :-). According to my
understanding of the documentation for exim's -bt and -brw options,
their output should allow me to determine what will happen to a given
message arriving at this server. Basically I have an address that I
never want to be rewritten, but it is being rewritten anyway despite
claims from -brw and -bt that it won't be.

For the address that concerns me, their output is as follows:

lurch:~# exim4 -brw mail2news-test@???
  sender: mail2news-test@???
    from: mail2news-test@???
      to: mail2news-test@???
      cc: mail2news-test@???
     bcc: mail2news-test@???
reply-to: mail2news-test@???
env-from: mail2news-test@???
  env-to: mail2news-test@???
lurch:~# exim4 -bt mail2news-test@???
R: system_aliases for mail2news-test@???
mail2news-test@??? -> |/usr/bin/mail2news -n reciva.mail2news-test
  transport = address_pipe

Many other addresses on the system are rewritten, but that shouldn't be
relevant in this case. I don't think my rewriting setup is doing
anything strange such as causing different originator addresses to be
treated differently. My rules are as follows:

"
begin rewrite

root@* *
www-data@* *
mail2news-test@??? *
*@*.nexus.co.uk $1@??? fFs
*@*.reciva.com $1@??? fFs

*@+local_domains ${lookup{${local_part}}lsearch{/etc/email-addresses}\
                   {$value}fail} Ffrs
*@lurch.nexus.co.uk ${lookup{${local_part}}lsearch{/etc/email-addresses}{$value
}fail} Ffrs
"

When I try and send a message to the address in question though, the
address gets rewritten anyway, as follows:

lurch:~# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 lurch.internal.reciva.com ESMTP Exim 4.50 Thu, 01 Dec 2005 12:24:41 +0000
helo lurch
250 lurch.internal.reciva.com Hello root at localhost [127.0.0.1]
mail from: mp@???
250 OK
rcpt to: mail2news-test@???
250 Accepted
data
354 Enter message, ending with "." on a line by itself
From: mp@???
To: mail2news-test@???

.
250 OK id=1EhnUg-0005SG-My
^]
telnet> Connection closed.
lurch:~# exigrep 1EhnUg-0005SG-My /var/log/exim4/mainlog
2005-12-01 12:25:11 1EhnUg-0005SG-My <= mp@??? H=localhost (lurch) [127.
0.0.1] U=root P=smtp S=346
2005-12-01 12:25:11 1EhnUg-0005SG-My ** mail2news-test@??? R=smarthost T
=remote_smtp_smarthost: SMTP error from remote mailer after RCPT TO:<mail2news-
test@???>: host mail.reciva.com [82.70.217.43]: 550 unknown user
2005-12-01 12:25:11 1EhnUg-0005SG-My Completed

2005-12-01 12:25:11 1EhnUt-0005SR-SZ <= <> R=1EhnUg-0005SG-My U=Debian-exim P=l
ocal S=1280
2005-12-01 12:25:12 1EhnUt-0005SR-SZ => mp@??? R=smarthost T=remote_smtp
_smarthost H=mail.reciva.com [82.70.217.43] X=TLS-1.0:RSA_AES_256_CBC_SHA:32
2005-12-01 12:25:12 1EhnUt-0005SR-SZ Completed

lurch:~#

Any help would be much appreciated, or a confirmation that this is
indeed a bug :-). If it will help I can try and make our complete exim
config file available.

Thanks,
Mike Pinna