[exim] How did this get through?

I added a little snippet to my ACL to
require HELO/EHLO before MAIL (it was
posted here the other day IIRC but it
might have been from the archive).

acl_check_sender:

     deny  condition = ${if \
           or{{!def:sender_helo_name}{eq{$sender_helo_name}{}}}{yes}{no}}
           message = HELO/EHLO required.

     accept

where acl_check_sender is the MAIL ACL.


So, I am now seeing the expected rejects
in my logs. But tonight I receive a
(spam) message with this header:

   Received: from [210.115.37.13]
      by [etc...]

Where a helo'd version would look like:

   Received: from [210.115.37.13] (helo=elsewhere.net)
      by [etc...]

How did it get through without a HELO?


TIA,

-dub