Does Exim run with different permissions between -bt and -bh, or between verifying and actual sending?

Yes. For -bt it runs as root, as it would when delivering a message. For -bh, -bv, and when actually receiving a message, it runs as the Exim user.

---