For recipient validation to be done right after the RCPT TO command, you have to be connected to a Hub Transport (as opposed to a Frontend Transport). I edited an existing Hub Transport bound to port 2525, checking the box to allow "Anonymous users" to connect to it (make sure to lock this down by some other means, so only known servers can access it).
Then I changed the settings on my gateway (postfix) server to use port 2525 when communicating with this exchange server. At this point the recipient validation started working as intended.