annoying procmailrc

I'm sending some of my email through a host that accepts email for any user
at any of my domains, but I don't want to start accepting email for every
random combination of a username a spam "dictionary" attack might throw at
it. So if it's for one of my domains, but *not* to one of the addresses I
maintain, I want to bounce it. But this recipe is driving me nuts. I can't
figure out if this isn't working because grep returns '0' on match, or if
procmails logical AND is weird... Hints?

#################################################################
# If to my domain, but not an address I maintain, bounce it

MY_ADDRESSES = $HOME/.myaddresses
MY_DOMAINS = $HOME/.mydomains
domain=`formail -x"From:" | awk -F@ '{print $2}' | sed -e 's/>//'`
tfield=`formail -XFrom: | formail -r -xTo: | tr -d ' '`

:0h
# if it's my domain (grep returns 0)
* ? grep -F -i -x -q "$domain" $MY_DOMAINS
# if it's not my address (grep returns 1)
* ! ? grep -F -i -x -q "$tfield" $MY_ADDRESSES
bounce