By accident for a short time we had a gwia visible from the internet and
configured without authentication. The gwia had a relay host configured,
relaying was disabled.

The only problem that I would have expected in that situation is that
our users would be victims of spam. I thought gwia should deny messages
to other domains than its own (those configured in Internet Addressing).
But it didn't! It accepted mails for and relayed it to the
relay host. Why?