One silly thing (but needs to be asked):
Did you rebuild access.db after editing access?
Yes, the rebuild command is built into my init script. I just double checked it.
I'm getting better results having changed the setting to REJECT instead of DISCARD. I will investigate a bit further when I have some spare time. For now I have verified that the mail server is rejecting all mails to the problem addresses.