Server 10.4 Mail Service being used as a bot?

[gobgobmacintire]

Using OS X Server 10.4 on an XServer. All software updated regularly. Generally no problems but I've noticed something odd in the Mail Service. When I go into Mail:Maintenance:Mail Queue there is ALWAYS a list of 20+ items and all of them are from "MAILER-DAEMON". Occasionally something is in the list and is from one of my users...that seems normal. These others seem like a problem. And this week my users are getting spam that is from other users (there are only about a dozen mail users on this server). I thought I had set it up per the specs in the manual to prevent an unauthorized relay. Security authentication set to IMAP=plain, clear, POP=clear, SMTP=none. Relay is "Accept SMTP from" and then lists the static IPs of the users, the two IPs of the XServe and 127.0.0.1/32. I must be missing something obvious. What should I be checking? Help please?