As mentioned by Alex, email's from local programs often get dumped right into the queue, bypassing all the network configs that you've deployed to block this.
The setting to control this local behavior is: authorized_submit_users
In your main.cf postfix config, you may have this line:
authorized_submit_users = static:anyone
It may not be set explicitly, but the above is the default, so ANY named user on localhost can submit directly to the queue. To block the submit queue completely, just define an empty list in main.cf:
or, I like to do the following to only allow root to submit on localhost:
authorized_submit_users = root