OK, confirmed the following from http://support.microsoft.com/?id=324958
Right-click Default SMTP Virtual Server and then click Properties.
Click the Access tab.
Click the Relay... button at the bottom.
The default settings block open relay. The default settings are as follows:
Select Only the list below.
The Computers dialog box shows Access Granted to the Internal IP address of the Small Business Server network and to the external IP address (if the server has more than one network card.)
Make sure that Allow all computers which successfully authenticate to relay, regardless of the list above is selected.
Set the Default SMTP Virtual Server configuration for relaying as indicated, which restores its settings to their defaults.
Testing by connecting on port 25 and sending mail to a outside domain from an outside domain works fine. However, my understanding of the above would lead me to believe that should not be possible. While doing this simple test, 12,000 SPAM messages are in my queue, although all messages are going to a non-existant smart host.
If i re-install SMTP, the telnet test shows that open relay is closed, adn the settings above are the same. But, of course Exchange doesn't work. As soon as i re-install Exchange 2003, the open relay is off and running again.
This is of course a major issue, and every time i find an article on how to close it, it is already closed, but as soon as SMTP is started it's wide open again. Anyone have any ideas at all?