We are testing GW8. Is there any way to use Outlook Express forcing to authenticate the user?

For some reason, I can connect with Outlook Express without SMTP authentication, send emails internally and to the internet without any problems. I can also change my email address to bobama@whitehouse.gov and send it to the internet too.

Under Access Control --> SMTP Relay, "prevent message relaying" is checked with no exceptions.
It seems that is not working as it should or, are we missing something?