As X-Istence says, the question is fundamentally bogus. There is no such thing as relay to a locally hosted mailbox. It's a conceptual error. Either the mailbox is remote, in which case the mail has to be stored and forwarded — i.e. relayed — to it, or the mailbox is local, in which case there is no relaying going on at all because the system is the final destination for the mail.
rcpthosts, which defines which domains the SMTP Relay server (
qmail-smtpd) will accept in envelope recipient mailboxes, is (usually) the union of all locally hosted domains and all domains for which mail is permitted to be relayed. That it has allowed a message from the outside world to be addressed to a locally hosted mailbox isn't an error. It's working as designed. If you do not want the outside world to be able to send mail to you, do not run an SMTP Relay server. Running an SMTP Relay server implies that you do want the outside world to be able to send mail to you.
The notion of authorization applies, obviously enough, to local users that you have a user database for, and thus applies to SMTP Submission, not to SMTP Relay. If you've been confused by the Old-Fashioned Mail Injection Protocol into thinking that SMTP Relay deals in authorization (when, of course, there's no way for you to have a user database listing the arbitrary people in South Africa or India or France who might want to send mail to you) then you need to re-familiarize yourself with the difference between SMTP Submission and SMTP Relay. This is the 21st century; we know about service separation nowadays; we shouldn't be using the OFMIP paradigm any more.