He's probaly using the DA Spamassassin interface and does not have to change this file in order to whitelist. You should check the header in the mail, you're exim's mainlog, maybe spamassassin log and last check the /home/[user]/.spamassassin/user_prefs if there are the whitelisted email adresses.