[exim] Reject mail which fails to find a router

We're using mysql to select specific forwarding/storage data for exim with the last two routers shown below which act as a 'catchall' and a wildcard forwarder.

The problem we've got is that if a customer has set up say bob@??? but not their * wildcard and someone emails tom@??? then rather than being rejected we're seeing
"stat=Deferred: 451 Temporary local problem - please try later"

The server logs showing
temporarily rejected RCPT tom@???: MYSQL: no data found

Given that 99.9% of this mail is spam, it's wasting resources as the sending servers keep trying every few hours because we're sending a temporary failure and not a full failure.

Can anyone give us a more suitable tweak to the last routers or ACL?

Thanks JL

mysql_catchall:
driver = redirect
file_transport = address_file
pipe_transport = address_pipe
data = ${lookup mysql{SELECT sendto FROM exim_forwarding WHERE (user='*' AND domain='$domain')}}

## recreates the %1@ sendmail fix
mysql_percent:
driver = redirect
file_transport = address_file
pipe_transport = address_pipe
data = ${quote:$local_part}@${lookup mysql{SELECT sendto FROM exim_forwarding WHERE (user='%1' AND domain='$domain')}}

####################################################################
#                       ACL CONFIGURATION                            #
#         Specifies access control lists for incoming SMTP mail      #
######################################################################

begin acl

  accept  hosts = : 127.0.0.1
  deny    local_parts   = ^.*[@%!/|] : ^\\.
  accept  local_parts   = postmaster
          domains       = +local_domains
  require verify        = sender
  accept  domains       = +local_domains
          endpass
          message       = unknown user
          verify        = recipient
  accept  domains       = +relay_to_domains
          endpass
          message       = unrouteable address
          verify        = recipient
  accept  hosts         = +relay_from_hosts
  accept  authenticated = *
  deny    message       = relay not permitted