I am going crazy over this, I have dozens on instances of Exchange running, one of the clients complained that he was doing tests and can send email using an SMTP tool without even being on the IP list of the relay connector.
Upon checking I found that if I used one of the accepted domains in the recipient the mail regardless of any connector there or not, would just pass and the email will be sent out. Not only that I can change the sender address to anything. If I use<g class="gr_ gr_545 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling ins-del" data-gr-id="545" id="545">any</g> external address in the recipient then it won't work (Need an external relay right...).
I have spent too many hours trying to get this restricted but cannot, because I cannot find a straight answer anywhere. My very straight question here is, is this really by default?
Has anyone overcome this?