What was really useful was creating a new server ('droplet') on Digital Ocean, putting just fail2ban and exim4 on it, then seeing that it worked. Total cost of a new server for an hour... less than a cent. Quite remarkable.
That led to purging and reinstalling them on the real server, and it works :)
I don't know why it didn't work before (or, putting it another way, why it works now) :( but..
This entry was originally posted at http://lovingboth.dreamwidth.org/522867.html, because despite having a permanent account, I have had enough of LJ's current owners trying to be evil. Please comment there using OpenID - have and if you have an LJ account, you can use it for your OpenID account. Or just join Dreamwidth! It only took a couple of minutes to copy all my entries here to there.