New 2013 Setup - Receive Connector Confusion

I currently have a 2010 environment and I am migrating to 2013.  I have two servers built and began to try to setupauthenticated relay and I got nowhere and really really confused.  I would think this would be a really simple implementation but apparently not :(  Long story short, I just want to get back to the default settings for the receive connectors on a dual role clean Exchange install.  

Are the below settings correct for the default install of Exchange?  Is anonymous included in the default frontend connectors?  If so, can someone please explain this to me?  

The reason I ask is that I would expect that when i telnet to the mail server on 25 and try to send an email, that I should not be able to do so.  But then I think about it and think that external senders would be unauthenticated and now i've confused myself. 

In that telnet session if i try to send an email to an external domain name it says unable to relay.  If i send to an accepted domain it works.  But isnt that a security risk to allow any device on the inside to send unauthenticated to an employee?

I really appreciate any clarification you can add.  

Here is my output for Get-ReceiveConnector | fl Name,AuthMechanism,RemoteIPRanges,TransportRole,permissiongroups,MaxMessageSize

Name             : Default BBC-EXCH02
AuthMechanism    : Tls, Integrated, BasicAuth, BasicAuthRequireTLS, ExchangeServer
RemoteIPRanges   : {::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 0.0.0.0-255.255.255.255}
TransportRole    : HubTransport
PermissionGroups : ExchangeUsers, ExchangeServers, ExchangeLegacyServers
MaxMessageSize   : 35 MB (36,700,160 bytes)

Name             : Client Proxy BBC-EXCH02
AuthMechanism    : Tls, Integrated, BasicAuth, BasicAuthRequireTLS, ExchangeServer
RemoteIPRanges   : {::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 0.0.0.0-255.255.255.255}
TransportRole    : HubTransport
PermissionGroups : ExchangeUsers, ExchangeServers
MaxMessageSize   : 35 MB (36,700,160 bytes)

Name             : Default Frontend BBC-EXCH02
AuthMechanism    : Tls, Integrated, BasicAuth, BasicAuthRequireTLS, ExchangeServer
RemoteIPRanges   : {::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 0.0.0.0-255.255.255.255}
TransportRole    : FrontendTransport
PermissionGroups : AnonymousUsers, ExchangeServers, ExchangeLegacyServers
MaxMessageSize   : 36 MB (37,748,736 bytes)

Name             : Outbound Proxy Frontend BBC-EXCH02
AuthMechanism    : Tls, Integrated, BasicAuth, BasicAuthRequireTLS, ExchangeServer
RemoteIPRanges   : {::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 0.0.0.0-255.255.255.255}
TransportRole    : FrontendTransport
PermissionGroups : ExchangeServers
MaxMessageSize   : 36 MB (37,748,736 bytes)

Name             : Client Frontend BBC-EXCH02
AuthMechanism    : Tls, Integrated, BasicAuth, BasicAuthRequireTLS
RemoteIPRanges   : {::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 0.0.0.0-255.255.255.255}
TransportRole    : FrontendTransport
PermissionGroups : ExchangeUsers
MaxMessageSize   : 35 MB (36,700,160 bytes)

Name             : Default BBC-EXCH01
AuthMechanism    : Tls, Integrated, BasicAuth, BasicAuthRequireTLS, ExchangeServer
RemoteIPRanges   : {::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 0.0.0.0-255.255.255.255}
TransportRole    : HubTransport
PermissionGroups : ExchangeUsers, ExchangeServers, ExchangeLegacyServers
MaxMessageSize   : 35 MB (36,700,160 bytes)

Name             : Client Proxy BBC-EXCH01
AuthMechanism    : Tls, Integrated, BasicAuth, BasicAuthRequireTLS, ExchangeServer
RemoteIPRanges   : {::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 0.0.0.0-255.255.255.255}
TransportRole    : HubTransport
PermissionGroups : ExchangeUsers, ExchangeServers
MaxMessageSize   : 35 MB (36,700,160 bytes)

Name             : Default Frontend BBC-EXCH01
AuthMechanism    : Tls, Integrated, BasicAuth, BasicAuthRequireTLS, ExchangeServer
RemoteIPRanges   : {::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 0.0.0.0-255.255.255.255}
TransportRole    : FrontendTransport
PermissionGroups : AnonymousUsers, ExchangeServers, ExchangeLegacyServers
MaxMessageSize   : 36 MB (37,748,736 bytes)

Name             : Outbound Proxy Frontend BBC-EXCH01
AuthMechanism    : Tls, Integrated, BasicAuth, BasicAuthRequireTLS, ExchangeServer
RemoteIPRanges   : {::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 0.0.0.0-255.255.255.255}
TransportRole    : FrontendTransport
PermissionGroups : ExchangeServers
MaxMessageSize   : 36 MB (37,748,736 bytes)

Name             : Client Frontend BBC-EXCH01
AuthMechanism    : Tls, Integrated, BasicAuth, BasicAuthRequireTLS
RemoteIPRanges   : {::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 0.0.0.0-255.255.255.255}
TransportRole    : FrontendTransport
PermissionGroups : ExchangeUsers
MaxMessageSize   : 35 MB (36,700,160 bytes)

---

NNatic