I spoke too soon - Exim gave up on me failing to start with an obscure message:
Exim configuration error in line 301 of /var/lib/exim4/config.autogenerated: group mail was not found

The group 'mail' was still there and id and getent commands confirmed it. With help from #debian@irc.debian.org I was able to figure out that /etc/groups had permissions of 0600 which made it unreadable for anyone except root. Doh!