@tomkern: The problem is that there is no prompt since the server sends the message and not a client. I know it's the same store and I don't want to filter RR requests just stop Exchange from automatically sending them.
I've played around with a raw connection to the server opened with openssl s_client and as soon as I send the following IMAP command to the Exchange server (a05 is the current command number and 31 is the message number in the current folder):
a05 fetch 31 body[text]
the exchange server sends the RR reply. The only expected result is to get the message body and add the "seen" flag to the message. There is no client involved in this test that can send the RR-message.
The exchange server also adds the recipient account name to the response telling the spammer the name associated with the email address. God to have for them to personalize the next spam message.