Recently I'm receiving (a lot of) spam with "mail from:" from legitimate users (on my server) but a different "Return path". This should not happen for our users, that is, mail received for firstname.lastname@example.org should allways have an equal return path "email@example.com".
I need to setup an exim4 filter rule that checks for "@mydomain.com" and then checks for the sender email address is the return path. If different, the email should be rejected.
I know there are situations this can be a legitimate use (like using gmail) but these are not allowed by our policy.
Can someone give me a hint where/how to implement this rule?