Howdy,
Looking at just this little bit I see a few things you could do. Messages you accept you have todo a lot with aka spamassassin/clamav, queue, bounce, and clean if none of this gets back to a sane person.
!!!WARNING!!! !!!WARNING!!! !!!WARNING!!! !!!WARNING!!!
Blocking mail at helo/ehlo will not leave a copy on the server. If you are forced to keep emails for compliance you may not be able to use this.
!!!WARNING!!! !!!WARNING!!! !!!WARNING!!! !!!WARNING!!!
1. You say helo I say 500 er goodbye
So the easiest way is to get strict on who you let get beyond helo/ehlo on your server. Cozy up to WHM and enter the Exim Configuration Manager. Under ACL Options you can select these as you see fit:
Require HELO before MAIL [?]
Require remote (hostname/IP address) HELO [?]
Require remote (domain) HELO [?]
Require RFC-compliant HELO [?]
2. You're on my list, and not the good list.
I like all but "Require remote (domain)" on my server and your mileage may vary. But RFC-Compliant HELO + Require a hostname is a good way to block most spam bots. It works like checking caller ID. The mail comes in to Exim, exim asks who it is, and if doesn't like it it "errors" to end the connection. A lot like sending a phone call to voicemail that you don't want to answer.
If you've rejected some messages there you might move on to adding RBL support. RBL support is a bit of a mixed back. I've had good luck with it on my own personal server but I know of some folks it won't work with their customers. If you can get away with it zen/spamcop can really help stop messages at the SMTP layer before you start getting data. This is very lightweight for Exim to drop (again like sending a phone call to voicemail).
3. I would not do such things if I were you
Ok I personally hate this option, but it works. So mid-message tranmission, while the server that is sending you mail is saying ehlo there, your server will reach back to the same IP and ask ehlo back. This echo echo goes on to the point of the server saying that there is a user on the other side of the same name. Most mail servers will be happy with it and your message gets through. There are some cases like password resets and web servers sending messages that have no mail server on them. These IP's would need to be whitelisted from this type of check.
Sender Verification [?]
This all goes wrong when your server gets blocked for terminating connections on the other server and then neither side is happy. This is also very hard to troubleshoot without admins on both sides, this is why I hate it.
Another option you can google to enable is greylisting. This hangs up on every SMTP connection the first time. Good mail servers will try back in 5 to 30 seconds depending on their retry settings. This works like an insurance company that denies all claims until someone appeals. Just about all mailservers have at least 1 retry (the RFC says they should try again). The message retries and gets queued with the rest. The customer rarely notices but non-mail servers that spam will get a rejection or two and move on to the next IP in the block.
4. Bonus Round - Don't let your users pollute my inbox (or anyone's for that matter).
Are you allowing your users to send mail via apache? It's likely you are, which is good it lets users automate tasks like lost passwords but let's do a few things to make life easier if a site gets exploited to send spam. Turn these two options on.
Query Apache server status to determine the sender of email sent from processes running as nobody [?]
Trust X-PHP-Script headers to determine the sender of email sent from processes running as nobody [?]
Scan outgoing messages for spam and reject based on SpamAssassin® internal spam_score setting [?]
Scan outgoing messages for malware [?]
If you're running anything that runs as a user for PHP it will mark the headers with the user on your system. This will make it easy to know which user on your system is sending out email if it ever comes up. Also it will prevent someone on the server from spamming someone else on the server. (This rarely happens unless you want to send your brother 50,000 message to get him to leave a meeting early (HI BRO)).
I hope all of this helps. I didn't mean to write a book but it's worth spending some quality time with exim every few months.
Thanks!
