Whitelist 127.0.0.1/32 Send mail from bogum mail adresses

[knocx]

Whitelist 127.0.0.1/32 and clients can send mail from bogusmail adresses

Hello;

on client php scripts we observe that people can send mail from forged mail adressess, since 127.0.0.1 is in whitelist

i.e a message from user@gmail.com to user@hotmail.com is relayed where user@gmail.com is a forged originator

or from support@paypal.com

since this is a serious security issue and hard to catch is there a way to restrict this action?

i donts understand why is Qmail relaying user@gmail.com, it shouldnt be allowed , by logic relay allowance priority should be based on "allowed hosts" rather than the trusted IP(127.0.0.1)... am i wrong? ...however it works the opposite.

any ideas / suggestions will be great

thanks
knocx