[exim] spam to mail/root

I am receiving loads of spam directed to mail|webmaster|root etc.

How do I configure exim to ensure that only locally generated mail and mail
from authorised hosts is delivered?

I am using exim4-daemon-heavy        4.60-3ubuntu3.1

My feeling was to create the following router in
001_exim4-config_non_local_system_mail

router_reject_non_local_system_mail:
    driver = reject
    local_parts = root : webmaster : mail
    senders = ! 127.0.0.1 : 10.0.0.2: 10.0.0.3
    domains = +local_domains

Any suggestions?

BTW. These emails are all Evelope-to: legaluser@???
but addressed in To: root@???

Thanks,
Pieter
--
Pieter Claassen