in your acl I do not see the sections that refer to these lists of
authorised hosts.
If these accept lines do exist, might it be that these clients have
changed IP or that the
/etc/virtual/pophosts file is not correctly updated anymore?
Why don't you look in your logs for the rejections?
(Besides, user not authorized does not appear to be a message that
your exim would give)
