[Exim] SMTP-Auth

I have mananged to get SMTP-Auth working but it seems to only requiring the
auth when sending email out of the server. When email is sent internally then
no auth is required. I would like to stop someone from using telnet to access
the server and send email from joesoap@??? to pandre@???,
with pandre being a 'live' email address. Is this possible and if so any
pointers.

Paulo