It seems that you have answered your own question, because everyone uses 550's. Were you looking for justification that sending back a 550 error response was what you were wanting to do? What are you looking for?
I assume that 550 replies was what I needed, but I was just wanted some assurance.
I would install a mail proxy box, running postfix, have it do all the nice and nasty stuff like screening out bad IP's, greylisting, tar-pitting, SPF, anti-virus scanning, invalid-user/550 responses, whatever... and then if the customer really wants to have an Exchange server, then the postfix machine can just nicely relay only the good messages to the internal Exchange server.
I'm getting there. I haven't offered to take on this project for fear of making my users dependent on a box that I'm not 100% confidant of administering.
