[exim] Strip IP address from received header

due to privacy issues I want to strip the IP address of authenticated
users from the received header. Currently i am adding a special header
in a content ACL when i receive mail from authenticated users:

  warn  message         = X-authenticated-user: $message_id
        authenticated = *

and afterwards I strip out the received header with a system filter and
add a new one:

if $header_X-authenticated-user: is $message_id
then
  headers remove Received
  headers remove X-authenticated-user
  headers add "Received: from 127.0.0.1 \n \t \
    by foo.example\n \t \
    id $message_id \n \t \
    for ???; $tod_full"
endif

this works, but the filter always adds the new received header at the
bottom of the header list. and i don't know how to get the "for" address.

any help is appreciated!