This is a valid concern and one I agree with. Apple needs to do something to make it easier for admins of OS X Server (and previously ASIP) to manage SMTP Relay. At the very least, Apple should ship the mail server enclosed within OS X Server with SMTP Relay turned OFF.

I do think you’re missing an important consideration, though. SMTP Relay has been part of mail servers for years. For a long time, it was a very useful iteration of the “open network” ideals of the Internet. Everyone could use everyone else’s services, etc. It’s the spammers’ abuse of these services that have forced mail admins to have to close off the SMTP Relay services inherent in the mail servers.

What Apple SHOULD do is incorporate SMTP-AUTH into the mail server in OS X Server. Why they haven’t is beyond me.

Your criticism is a valid one and it should be shouted loudly at Apple. Singling out Apple for providing a service inherent in mail srvers for decades isn’t fair. Singling out Apple for shipping a mail server with a less-than-perfect SMTP Relay configuration is fair. - Damien.

Tis true and Apple should get their act together as Damien notes. I would submit, however, that the number of Microsoft based Internet servers far exceeds the number of Mac OS based Internet servers and that is why you haven’t heard much about this. If an OS with comparable server numbers, say Linux, shipped with a similar issue, you’d hear about it. (Of course in that case it would fixed immediately.)

Microsoft has had their share of relay issues.

http://www.microsoft.com/technet/security/bulletin/ms01-037.asp
http://www.microsoft.com/security/bulletins/ms99-027.asp

The peep is proportional to the pop