I've received a message which does not have my address in the To: line. It is a spam message with the same address in both the From: and the To: headers. How can this happen, and why doesn't Exim reject it?

There is an important distinction between the envelope from and to and the header from and to. The former are sometimes called the sender and recipient . An email message needs an envelope for the same reason that paper mail does - the envelope tells the delivery mechanism what to do with this copy of the message, whereas the To: header lists all the recipients, including those who have been sent different copies of the message because their mailbox is on some other host. An MTA such as Exim works entirely with the envelope > addresses, not with those in the header lines. Don't try to block mail

where envelope from and the header from differ. There are common legitimate cases where this happens, for example, messages forwarded from mailing lists and delivery failure reports.