You will need to:
1.Setup a working Exim server
2.Setup authentication (eg cram_md5) (see section 35.1 of the manual)
begin authenticators
cram_md5_server:
driver = cram_md5
public_name = CRAM-MD5
server_secret = ${lookup{$1}lsearch{CONFDIR/crammd5.config}{$value}fail}
server_set_id = $1
3.Set the server to require tls (see section 38.1 of the manual)
auth_over_tls_hosts = *
4.Configure sender rewriting (section 34.10 of the manual, examples from same)
*@*.hitch.book.fict $1@hitch.book.fict
*@hitch.book.fict ${lookup{$1}dbm{/etc/realnames}\
{$value}fail}@hitch.book.fict bctfrF
There is a useful guide here to rewriting. Note that rewriting is often frowned upon as the reasons for rewriting are often nefarious.
You can test rewriting with exim -brw <test_address>
.