Found it out myself via the excellent Exim Wiki:
First of all you have to create a file /etc/exim4/conf.d/router/899_exim4-config_local_user_spam with this content:
### router/900_exim4-config_local_user_spam
#################################
# This router matches local user mailboxes. If the router fails, the error
# message is "Unknown user".
local_user_spam:
debug_print = "R: local_user_spam for $local_part@$domain"
driver = accept
domains = +local_domains
check_local_user
local_parts = !www:!root:!nobody:!postmaster:!abuse:!admin
transport = maildir_spam_delivery
condition = ${if def:h_X-Spam-Flag: {true}}
cannot_route_message = Unknown user
This will be matched BEFORE the local user router which has number 900. This ensures that spam will be delivered using the following transport.
Create a transport in /etc/exim4/conf.d/transport/30_exim4-config_maildir_spam_delivery with this content:
### transport/30_exim4-config_maildir_spam_delivery
#################################
# Use this instead of mail_spool if you want to to deliver to Maildir in
# home-directory - change the definition of LOCAL_DELIVERY
#
maildir_spam_delivery:
debug_print = "T: maildir_spam_delivery for $local_part@$domain"
driver = appendfile
.ifdef MAILDIR_HOME_MAILDIR_LOCATION
directory = MAILDIR_HOME_MAILDIR_LOCATION/.Junk
.else
directory = $home/Maildir/.Junk
.endif
.ifdef MAILDIR_HOME_CREATE_DIRECTORY
create_directory
.endif
.ifdef MAILDIR_HOME_CREATE_FILE
create_file = MAILDIR_HOME_CREATE_FILE
.endif
delivery_date_add
envelope_to_add
return_path_add
maildir_format
.ifdef MAILDIR_HOME_DIRECTORY_MODE
directory_mode = MAILDIR_HOME_DIRECTORY_MODE
.else
directory_mode = 0700
.endif
.ifdef MAILDIR_HOME_MODE
mode = MAILDIR_HOME_MODE
.else
mode = 0600
.endif
mode_fail_narrower = false
# This transport always chdirs to $home before trying to deliver. If
# $home is not accessible, this chdir fails and prevents delivery.
# If you are in a setup where home directories might not be
# accessible, uncomment the current_directory line below.
# current_directory = /
This is basically a copy of the defailt maildir_home transport, only appending /.Junk to the maildir name.
I am sure that exim4 can do this a bit more elegant with some if and else, but my exim foo is not good enough yet. Any exim professionals are welcome to add to this solution.