[exim] Router weirdness

Hi,

I am running into something I don't understand, so I come here for help :-)

I am trying to bounce certain mail (identified spam) from a router. In
this particular case, I can't reject the mail during SMTP, because one
of my users doesn't want this kind of mail rejected, while others do.

So, in this case, the mail is scanned, but never rejected. I have a file
that contains all the domains that want to keep their spam:

domainlist spam_domains = CONFDIR/spam_domains

My first router looks like this:

bounce_spam:
         driver                  = redirect
         domains                 = !+spam_domains
         allow_fail
         condition               = ${if >{$spam_score_int}{65}{1}{0}}
         data                    = :fail: This message was classified as 
SPAM

Now, while testing this setup, I see something I don't get. The
spam_domains file contains on this single line:

tinuzz.com

Now, I expect mail that is addressed to anyone@??? to never be
bounced by this router. However, it is:

2006-03-03 12:07:12 1FF87Z-0007sS-5z ** martijn@???
<martijn@???> R=bounce_spam: This message was classified as SPAM

In a later router, martijn@??? is redirected to martijn@???,
and sipo.nl is not in +spam_domains, so that part I do understand. Even
so, if I put sipo.nl in spam_domains, the mail is passed, as expected.

What I _don't_ understand is, how the message even gets to that second
router. It should just be failed by the router above en the redirection
to martijn@??? should never take place. What am I missing here?

Thanks for any advice,
Martijn.