Try something like this:
acl_check_not_smtp:
accept condition = ${if match_local_part{$authenticated_id}\
{:root:Debian-exim:cgi-bin}}
deny logwrite = LOCAL-DENY=$authenticated_id
Should deny the www user I would have thought. You could always flip the logic
to deny www user only and accept everone else.
I'm considering something like this myself, but am yet to test/implement it.