Two quick comments:
1) After changing the configuration for other reasons, unsigned bounces were
not being rejected. You might want to check the value for "accept hosts" in
the ACL, like here:
acl_check_rcpt:
accept hosts = :
# this may not break it
and definitely watch what you put here:
# main section
hostlist relay_from_hosts = 127.0.0.1
2) The test mode "exim -bh" is absolutely wonderful.