Symptoms
When you have configured your Exim filter with contains, some emails are being filtered correctly. However, other emails are being filtered despite not having the keywords in the email.
Description
This occurs because of the way that Exim filters work. When you're using contains, it will search for the keywords that you have configured in the message. However, it will not search only for whole words, but for the word within words.
For example, you have configured an Exim filter that triggers if the message contains BTC in the body. If you attach a PDF document to your email, it will be encoded in base64. While the message does not even mention BTC, the message triggered the Exim filter. This occurs because within the encoded base64 PDF attachment we can observe the following:
[...]
SQ13ib/2Xj9bOdA1urHu/x/MD2+sYnXhuuH/NkGANZAIM4VoSIW7MAvmwWxYCRtgLXhAMot0BiyE
H+BHmAtLIAkRbPAEVsFG+Bs8hWeQCZvhJBTCFhgMQyAFhkIRDIMTcArOwmkohjNwD2LhPJyDEtgK
n8FjmA8XoBTKYDg8AAd8B3EwAkbCKIiHzyEdRsNYGANfwJcwHsbBBJgI9+ErmAyT4GuYAt9ALmTA
[...]
Above is a part of the encoded base64 PDF attachment. In this part of the attachment we can observe, that contains BTC:
CZvhJBTCFhgMQyAFh
As mention previously, Exim Filter will not only search for whole words but also the word surrounded by other characters as well. It's not necessarily that the message contains the word BTC, but the encoding of the message or attachment does.
Workaround
Instead of using contains use RegEx as with RegEx you can specify a specific pattern to search for.