How to prevent open relay with exim

We use the following rules in acl_check_rcpt, but I suspect they would work better in acl_check_helo

deny
   condition      = ${if and{{eq{$interface_port}{587}} {eq{$tls_cipher}{}} } }
   message        = All port 587 connections must use TLS

deny condition    = ${if eq{$interface_port}{587}}
   !authenticated = *
   message        = All port 587 connections must be Authenticated

Obviously you only want the second of the two rules, but the first shows how to reject non-TLS connections. You may want to think about disallowing plaintext authentication methods if you aren't going to enforce TLS.

IMHO, your best option is using an exim/spamassassin combination, cofigured to reject mail at STMP time (i.e. before accepting it) to mitigate backscatter.

Add in some RBL whitelisting/blacklisting to refuse or (better?) greylist inbound mail at connection time.

This should be sufficient to reduce the queue size.

There's lots of info on how to configure exim+spamassassin, as a start take a look here.