I configured our mail server to only accept mail from our internal work IP address and from authorised users.
So if one of your office PCs catches an e-flu, it will have no trouble using your mailserver to spread spam.
The way I see it, the only way is to make SMTP authentication mandatory _everywhere_ (except perhaps on your desktop localhost, which should accept mail from you, but should be required to authenticate when pushing your outgoing mail to your upstream mailserver).
So if one of your office PCs catches an e-flu, it will have no trouble using your mailserver to spread spam.
The way I see it, the only way is to make SMTP authentication mandatory _everywhere_ (except perhaps on your desktop localhost, which should accept mail from you, but should be required to authenticate when pushing your outgoing mail to your upstream mailserver).