You need to adjust a few settings in Qmail.
Put all the domains that recieve mail in /var/qmail/control/rcpthosts
That will shutdown your open relay.
That one file will only allow people to send mail to your box if and
only if the TO: is addressed to a domain listed in rcpthosts,
everything else will be rejected.
If people must be able to route mail through you run tcpserver, the
qmail faq covers that very well. If they roam, enable roaming users
in vpopmail and force pop before smtp.
Also think about using the SpamControl patches at
http://www.fehcom.de/qmail/spam.html
Philip Wall