-A delivery process retains root privilege throughout most of its execution,
-but any actual deliveries (that is, the transports themselves) are run in
-subprocesses which always change to a non-root uid and gid. For local
-deliveries this is typically the uid and gid of the owner of the mailbox; for
-remote deliveries, the Exim uid and gid are used. Once all the delivery
+A delivery process retains root privilege throughout most of its execution.,
+including while the recipient addresses in a message are being routed.
+
+.ilist
+However, if a user's filter file has to be processed,
+this is done in a subprocess that runs under the individual user's uid and
+gid. A system filter is run as root unless &%system_filter_user%& is set.
+.endlist
+
+Any actual deliveries (that is, the transports themselves) are run in
+subprocesses which always change to a non-root uid and gid.
+.ilist
+For local
+deliveries this is typically the uid and gid of the owner of the mailbox.
+.next
+For remote deliveries, the Exim uid and gid are used.
+.endlist
+
+Once all the delivery