Starting on Mail | Security | General tab in admin console, make sure "Reject if originator's domain is local and not authorized" is enabled. This will require connections sending from a local domain to a remote be authenticated either by SMTP AUTH, or by POP before SMTP if that is allowed.

On the Advanced tab, the option "Relay only if originator's domain is local" MUST be enabled, otherwise your server is an open relay. Optionally, you may also enable "Reject if SMTP AUTH different from sender" which only allows sending as the authenticated user, i.e. if the connection authenticates as userA@domain but tries to send a message from userB@domain it will be rejected. This option prevents legitimate users sending as other users, which may be a security benefit (unrelated accounts in the domain e.g. ISP), or may be a hindrance if sending on behalf of others is necessary functionality (e.g. company domain).