I use the RBL-style DNS list of backscatter-generating mail servers at ips.backscatterer.org.
When I get a message that looks like a bounce (i.e. its envelope has an empty sender), if the
sender is listed at ips.backscatterer.org then I reject the message.
The disadvantage of this is that genuine bounces from listed domains will be lost. But not
other email from them.
The backscatterer.org list doesn't seem to be very comprehensive; I'm not sure where the data
comes from. I still get significant bursts of backscatter and I haven't measured how many
messages are rejected by this rule during those bursts.
Also, some backscatter doesn't have the empty sender that a normal bounce does - for example,
vacation messages. So these still get through.
Here's the exim.conf fragment that I use; it lives in the acl_check_data section:
deny senders = :
dnslists = ips.backscatterer.org
message = This message looks like a bounce, and your server is listed at \
ips.backscatterer.org, so I assume that this is "backscatter". \
Please configure your mail server to not send "backscatter spam". \
For advice, try http://www.dontbouncespam.org/