About 99% of all emails to us with this question end up being da-popb4smtp causing confusion, and not an open relay. Â What da-popb4smtp does is adds your own IP to the /etc/virtual/pophosts for 30 minutes file after you've authenticated with pop or imap. Â Any IP in this file can send emails freely without smtp authentication, but since you've already authenticated with pop, you're a valid user anyway, so it's not an issue.
You can check if you have an open relay at dnsreport.com as they have an open relay check in their mail settings check.
You should almost never have any domains listed in the /etc/virtual/whitelist_domains file as any email with any from address as any domain in that file can relay through your server. Â Use it as a last resort only. Â Be especially careful to NOT have commonly forged domains, such as hotmail, gmail, etc., in that file.