Karsten,
I approached Cisco with this feature request several times, but always received the same answer as here in the blog: Moving the message filter checks before the end of the SMTP dialog would require a large rewrite of the code and is a lot of work. There are open tickets about this, but no progress has been made yet.

This is a shame, because the ESA is a fine product otherwise, but to my knowledge the only widespread MTA which doesn't support rejecting emails based on message filter checks. Most on-premise competitors, be it commercial or free, offer this feature.