I think someone may have been silly enough to put in some broken rule to reject email from notes@*. Maybe with the flawed idea it could prevent some spam. I would say grep for "notes" in the exim configuration directory and see what hits you get.
From experience I know there are few or no configuration files in exim that contain the string "notes" by default, so anything that turns up should lead you in the right direction. Remove or comment out any suspect entries you find, reload exim and see if that fixes it.
If there is a proxying spam filter in between such as ASSP you may need to scrutinise that configuration as well.
Update: To answer a comment about quarantining.
Quarantining is only helpful for a limited amount of spam you are not sure about, even then the human factor comes in the way. People will quickly get annoyed and ignore the quarantine thing right away.
Normally you block spam at an early stage of the smtp interchange. It will be grey listed, or the connection is denied due to an IP block list, there is no valid helo, or no valid reverse dns. At this stage no email body has yet been transferred and as such there has been very little traffic. These are cheap and very effective ways to block 95%+ of all spam with very little chance of false positives.
If the spam passes these checks you have less precise and more resource intensive scans such as bayesian scanning and virus scanning. If an email does not pass that scan you block it and you could consider to quarantine the emails that have the lowest score (i.e. it's looking a lot like a legit email).
If you would quarantine all emails that would be blocked the user gets information overload and your system has to handle all that extra traffic, including increased disk usage. The user will NOT sift through thousands of spam to find one legitimate email. So your user will still miss out on "that important email".
As far as I know big email providers work in a similar way, it's common practice.