Check the thread I just closed ahead of this one ("Ex2k still relaying email insecurely"

... you may have the same problem.
Make certain that in your SMTP connector (In your Routing Groups) that in the Address Space tab, you have the following 3 items:
1) You have an address space defined as *
2) You have the item "Allow messages to be relayed to these domains" UNCHECKED.
3) You have the connector scope defined as "Entire Organization" (unless you need to route only for a specific routing group)
Item 2 is what had me baffled. It was explained to me that because you define in item 1 that ALL domains are to be relayed, you need to clear out item 2 or you will allow anything to be relayed to any address space FROM any address space. So you will be an open relay.
Clearing the box will not stop authenticated users (such as your users that use POP/SMTP instead of IMAP)from relaying, as Exchange will allow them to relay since they are identified as a legal user.
So if you have followed the instructions about setting up the connector (Q265293), and then the instructions on how to stop the relay (Q310380), and had NOT cleared the box as outlined in item 2 above, you would still open relay.
Hope this helps.