[exim] acl_check_rcpt problems (using catchall router)

I'm using exim4 with a catchall router to forward mail to a java process.
The java process users are the valid recipients. I'm trying to reduce the
amount of spam routed to the java process by whitelisting the users in exim.

I have tried this in my config file

acl_check_rcpt:

deny message = invalid recipient

domains = thedomain.com

recipients = !/etc/exim4/recipients_whitelist

Along with about a billion other things. I have verified that if I rewrite
the condition as just "deny" or "deny recipients = foobar@???"
the message is rejected but I cannot get the whitelisting approach to work.
I have also tried inverting the logic to accept the whitelisted users but
that does not work either.

Here is my router

outer_catchall:

driver = accept

transport = dev_null_transport

I appreciate the help.