Why is This message being relayed?

Question

I have my relay settings to only accept 127.0.0.0/8 and 192.168.88.0/24, so how did this message get through?
Dec  5 19:55:34 mycompany postfix/smtp[24709]: 6852E91833E: to=<[email protected]>, relay=cluster4.us.messagelabs.com[216.82.250.19]:25, delay=256, delays=0.01/0.01/69/186, dsn=2.0.0, status=sent (250 ok 1323136534 qp 15594 server-5.tower-87.messagelabs.com!1323136279!47765957!1)
This weekend I found that someone was sending thousands of spam messages through my server even though I use authentication.

Answer 1

You need to look further back in your logs for the answer.
Dec  5 19:55:34 mycompany postfix/smtp[24709]: 6852E91833E: to=<[email protected]>, relay=cluster4.us.messagelabs.com[216.82.250.19]:25, delay=256, delays=0.01/0.01/69/186, dsn=2.0.0, status=sent (250 ok 1323136534 qp 15594 server-5.tower-87.messagelabs.com!1323136279!47765957!1)
The 'Accept SNMP relays...' option only relates to blind/untrusted relaying - if a connection comes from these IP addresses then accept the message, but that's not the only method that postfix will allow. If a user authenticates against the server (using one of the authentication methods you've selected) then they can also relay mail, regardless of their IP address.
Therefore, my first guess would be that someone's guessed a valid username/password on your server and is therefore using an authenticated connection. This can happen easily if users don't have strong passwords.
You'll need to track back through your logs to find where this message was injected into the mail queue.  Start off by searching for that message ID (6852E91833E) in the logs, or look back in time (this message has been in the queue for 256 seconds. Eventually that will tell you where it came from, and what user authenticated the connection. Then shut down that account until you can change that user's password and educate them on how to choose effective passwords.